BugRater
Early access: the directory is still filling out, and every rating here is a reported experience.

Security releases

Microsoft

September 2026 Early Security Updates

2026-Sep Sep 3, 2026 Source: Vendor

Imported by the Microsoft release catcher from the MSRC CVRF API (2026-Sep, revision 2026-09-06T04:36:00Z). 80 vulnerabilities, 8 of them carrying an acknowledgement. Draft. Review before publishing.

Source of record The credited names below are quoted verbatim from the vendor's own advisory: https://msrc.microsoft.com/update-guide/releaseNote/2026-Sep
Are you credited here? Sign in and claim your line: it is yours immediately, no review queue. The name the vendor printed stays next to your handle for anyone to check against the advisory above, and any member who thinks a claim is wrong can refute it.

Credited

1578 lines
All 1578 CVEs 1578 Additional recognition 0 Unclaimed only
Showing 1–50 of 1578 · page 1 of 32
CVE-2026-62906 BR2026-0000-010141 unclaimed
Microsoft Discovery Studio Information Disclosure Vulnerability
Credited as XBREACH TEAM with XBREACH.AI
CVE-2026-62916 BR2026-0000-010142 unclaimed
Microsoft Entra ID Elevation of Privilege Vulnerability
Credited as Asaf Cohen with XBREACH.AI
CVE-2026-65818 BR2026-0000-010143 unclaimed
Power Automate Elevation of Privilege Vulnerability
Credited as Adrian-Daniel Bacanu with Razdon
CVE-2026-65818 BR2026-0000-010144 unclaimed
Power Automate Elevation of Privilege Vulnerability
Credited as Firas Fatnassi 🇹🇳
CVE-2026-69857 BR2026-0000-010145 unclaimed
Azure Cosmos DB Spoofing Vulnerability
Credited as Taylor O'Dell with Microsoft
CVE-2026-70178 BR2026-0000-010146 unclaimed
Microsoft Fabric Elevation of Privilege Vulnerability
Credited as Taylor O'Dell with Microsoft
CVE-2026-70352 BR2026-0000-010147 unclaimed
Azure AI Language Elevation of Privilege Vulnerability
Credited as Vamsi Nukavarapu with Microsoft
CVE-2026-83711 BR2026-0000-010148 unclaimed
Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
Credited as Brian Ombongi
CVE-2026-83941 BR2026-0000-010149 unclaimed
Entra ID Elevation of Privilege Vulnerability
Credited as Brian Ombongi
CVE-2026-34182 BR2026-0000-010260 unclaimed
CMS AuthEnvelopedData Processing May Accept Forged Messages
Credited as PatrickD [GER/BW]
CVE-2026-47297 BR2026-0000-010261 unclaimed
Microsoft SQL Server Remote Code Execution Vulnerability
Credited as Piotr Bazydło (@chudypb)
CVE-2026-50349 BR2026-0000-010262 unclaimed
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Credited as Kim Dowon, Kang Minju, Kim Donggeon, Park Seungyeon with Best of the Best 14th
CVE-2026-56172 BR2026-0000-010263 unclaimed
Windows VHD miniport driver Elevation of Privilege Vulnerability
Credited as Chen Le Qi (@cplearns2h4ck) with STAR Labs SG Pte. Ltd.
CVE-2026-56172 BR2026-0000-010264 unclaimed
Windows VHD miniport driver Elevation of Privilege Vulnerability
Credited as Divya Sundar with Microsoft- MSRC V&M
CVE-2026-56172 BR2026-0000-010265 unclaimed
Windows VHD miniport driver Elevation of Privilege Vulnerability
Credited as Aobo Wang
CVE-2026-56172 BR2026-0000-010266 unclaimed
Windows VHD miniport driver Elevation of Privilege Vulnerability
Credited as Seung Chan Kim
CVE-2026-56177 BR2026-0000-010267 unclaimed
Windows Server Elevation of Privilege Vulnerability
Credited as k0shl
CVE-2026-56198 BR2026-0000-010268 unclaimed
Microsoft Trace Data Helper Elevation of Privilege Vulnerability
Credited as Zhang WangJunJie@Hillstone, He YiSheng
CVE-2026-56198 BR2026-0000-010269 unclaimed
Microsoft Trace Data Helper Elevation of Privilege Vulnerability
Credited as yhw
CVE-2026-56198 BR2026-0000-010270 unclaimed
Microsoft Trace Data Helper Elevation of Privilege Vulnerability
Credited as txz
CVE-2026-57098 BR2026-0000-010271 unclaimed
Microsoft Remote Desktop App for Windows Information Disclosure Vulnerability
Credited as Zoltan Harmath with Microsoft
CVE-2026-57099 BR2026-0000-010272 unclaimed
ASP.NET Core Denial of Service Vulnerability
Credited as Kevin Gosse
CVE-2026-58599 BR2026-0000-010273 unclaimed
HEVC Video Extensions Remote Code Execution Vulnerability
Credited as Kyeongmin Kim (@hareh4ru) with KAIST Hacking Lab
CVE-2026-58599 BR2026-0000-010274 unclaimed
HEVC Video Extensions Remote Code Execution Vulnerability
Credited as Jean-Jamil Khalife with HDWSec
CVE-2026-58600 BR2026-0000-010275 unclaimed
HEVC Video Extensions Elevation of Privilege Vulnerability
Credited as Kyeongmin Kim (@hareh4ru) with KAIST Hacking Lab
CVE-2026-58611 BR2026-0000-010276 unclaimed
Xbox Gaming Services Elevation of Privilege Vulnerability
Credited as Álvaro Muñoz
CVE-2026-58649 BR2026-0000-010277 unclaimed
.NET Information Disclosure Vulnerability
Credited as Weeraphat Srisutham
CVE-2026-62694 BR2026-0000-010278 unclaimed
Windows Installer Elevation of Privilege Vulnerability
Credited as Q4n with Kunlun Lab
CVE-2026-62694 BR2026-0000-010279 unclaimed
Windows Installer Elevation of Privilege Vulnerability
Credited as k0shl
CVE-2026-62694 BR2026-0000-010280 unclaimed
Windows Installer Elevation of Privilege Vulnerability
Credited as Zhang WangJunJie with Hillstone Networks
CVE-2026-62697 BR2026-0000-010281 unclaimed
Windows Push Notifications Elevation of Privilege Vulnerability
Credited as Q4n with Kunlun Lab
CVE-2026-62697 BR2026-0000-010282 unclaimed
Windows Push Notifications Elevation of Privilege Vulnerability
Credited as k0shl
CVE-2026-62697 BR2026-0000-010283 unclaimed
Windows Push Notifications Elevation of Privilege Vulnerability
Credited as Ezrak1e
CVE-2026-62706 BR2026-0000-010284 unclaimed
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Credited as cyanbamboo
CVE-2026-62706 BR2026-0000-010285 unclaimed
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Credited as b2ahex
CVE-2026-62744 BR2026-0000-010286 unclaimed
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Credited as Kyeongmin Kim (@hareh4ru) with KAIST Hacking Lab
CVE-2026-62759 BR2026-0000-010287 unclaimed
Windows Netlogon Spoofing Vulnerability
Credited as Microsoft
CVE-2026-62762 BR2026-0000-010288 unclaimed
Windows Active Directory Domain Services Denial of Service Vulnerability
Credited as WARP
CVE-2026-62762 BR2026-0000-010289 unclaimed
Windows Active Directory Domain Services Denial of Service Vulnerability
Credited as ACS teams at Microsoft
CVE-2026-62801 BR2026-0000-010290 unclaimed
Microsoft PowerShell Security Feature Bypass Vulnerability
Credited as yhw
CVE-2026-62801 BR2026-0000-010291 unclaimed
Microsoft PowerShell Security Feature Bypass Vulnerability
Credited as txz
CVE-2026-62801 BR2026-0000-010292 unclaimed
Microsoft PowerShell Security Feature Bypass Vulnerability
Credited as Mohit_Negi with Bugcrowd
CVE-2026-62801 BR2026-0000-010293 unclaimed
Microsoft PowerShell Security Feature Bypass Vulnerability
Credited as ECooper with Aretiq.AI
CVE-2026-62801 BR2026-0000-010294 unclaimed
Microsoft PowerShell Security Feature Bypass Vulnerability
Credited as Charlie Vogt
CVE-2026-62801 BR2026-0000-010295 unclaimed
Microsoft PowerShell Security Feature Bypass Vulnerability
Credited as Petr Pavlat
CVE-2026-62801 BR2026-0000-010296 unclaimed
Microsoft PowerShell Security Feature Bypass Vulnerability
Credited as hir0ot with SHFSEC
CVE-2026-62801 BR2026-0000-010297 unclaimed
Microsoft PowerShell Security Feature Bypass Vulnerability
Credited as Rayhan Destian
CVE-2026-62804 BR2026-0000-010298 unclaimed
Microsoft Word Remote Code Execution Vulnerability
Credited as tiebuchen
CVE-2026-62804 BR2026-0000-010299 unclaimed
Microsoft Word Remote Code Execution Vulnerability
Credited as Peter Eberhardy
CVE-2026-62804 BR2026-0000-010300 unclaimed
Microsoft Word Remote Code Execution Vulnerability
Credited as Matthew Yu