Multiple CVEs Disclosed on September 8, 2026, Affecting Microsoft Products

• •Multiple CVEs disclosed on September 8, 2026, affecting Microsoft products.
• •CVE-2026-85880 is actively exploited and added to CISA's KEV list.
• •Organizations are urged to apply patches immediately to mitigate risks.

On September 8, 2026, multiple CVEs were disclosed affecting various Microsoft products, including SharePoint and Office. Key vulnerabilities include improper access controls, buffer overflows, and command injections, which could allow unauthorized code execution and information disclosure. CVE-2026-85880, noted for active exploitation, was added to CISA's KEV list on the same day. Other vulnerabilities, such as CVE-2026-69428 and CVE-2026-69621, also pose significant risks due to their potential for exploitation. Organizations using affected versions of Microsoft products are urged to apply patches immediately to mitigate risks. The vulnerabilities impact a range of systems, including SharePoint Server and Microsoft Office, and could lead to severe consequences if exploited.