Multiple CVEs Disclosed for Microsoft Products
Article Content
- •CVE-2026-54990 allows remote code execution via malicious RDP servers.
- •CVE-2026-42914 can cause denial of service under specific conditions.
- •CVE-2026-44814 may lead to local information disclosure.
On September 8, 2026, Microsoft published advisories for three critical vulnerabilities affecting its products. CVE-2026-54990 is a heap-based buffer overflow in the Remote Desktop Client, allowing unauthorized code execution via a malicious RDP server. CVE-2026-42914 is an out-of-bounds read in Windows Kerberos, enabling authorized attackers to cause denial of service under specific conditions. CVE-2026-44814 involves an out-of-bounds read in the Windows DWM Core Library, which could lead to local information disclosure. The vulnerabilities were released between June and July 2026, with the latest updates provided on September 8, 2026. Successful exploitation of these vulnerabilities requires user interaction or specific configurations. Microsoft has acknowledged these vulnerabilities and provided guidance for mitigation.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (8)
Continue Reading
Critical BeyondTrust 9.3 Vulnerability Actively Exploited by Threat Actor A critical vulnerability (CVE-2026-102764) in BeyondTrust Remote Support has been discovered and is actively being exploited by the threat group ARMORY CASTLE, reportedly linked to China. The vulnerability, which has a CVSS score of 9.3, allows unauthenticated attackers to upload files and potentially compromise host…