Multiple CVEs Disclosed for Microsoft Products with Privilege Escalation Risks
Article Content
- •Multiple CVEs disclosed affecting Microsoft products, with risks of privilege escalation.
- •Attack vectors include malicious Office files and specific protocol settings.
- •Microsoft advises immediate application of security updates to mitigate vulnerabilities.
On September 15, 2026, Microsoft disclosed several vulnerabilities affecting its products, including CVE-2026-55121, CVE-2026-62753, CVE-2026-62721, CVE-2026-49805, CVE-2026-61923, CVE-2026-50683, and CVE-2026-50688. These vulnerabilities include out-of-bounds reads, heap-based buffer overflows, and improper access controls, allowing attackers to elevate privileges to SYSTEM level. The vulnerabilities affect various Microsoft products, including Windows and Microsoft Office. Attack vectors include malicious Office files and specific protocol settings. The vulnerabilities have varying levels of attack complexity, with some requiring user interaction. Microsoft recommends applying security updates as soon as possible to mitigate risks. The CVEs have been assigned CVSS scores indicating potential impacts on confidentiality, integrity, and availability.
Ask AI about this cluster
Answers cite the sources they use
Timeline
More articles in this cluster (16)
Following this threat?
Track CVE-2026-62721 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.
Free account · no card needed
Continue Reading
China-Linked Hackers Exploit PHP2Shell Vulnerabilities to Breach U.S. Government Systems On October 21, 2026, the PHP development team released patches for two critical vulnerabilities in PHP, known as PHP2Shell (CVE-2026-109618 and CVE-2026-109619), which allow unauthenticated remote code execution. These vulnerabilities were actively exploited by a suspected China-linked threat actor who compromised 25… 
Chinese Actor Compromises US Government Networks via PHP2Shell Exploit A suspected Chinese nation-state actor exploited vulnerabilities in Palo Alto Networks firewalls using a chained PHP2Shell exploit and a Linux kernel privilege escalation flaw. The attack, which began on October 23, targeted 25 servers across the US, Japan, Taiwan, and South Korea, with a focus on US…