Consulta vulnerabilidades CVE, conoce su impacto y verifica las medidas de corrección en fuentes oficiales.
CVE
Riesgo
KB asociado
Descripcion del KB
Fecha de liberacion
CVE-2026-62911
Critical
N/D
5121575
11/08/2026
CVE-2026-62918
Critical
N/D
Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform spoofing over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
11/08/2026
CVE-2026-63385
Critical
N/D
N/D
11/08/2026
CVE-2026-63508
Critical
N/D
Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
11/08/2026
CVE-2026-63509
Critical
N/D
Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
11/08/2026
CVE-2026-63513
Critical
N/D
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
11/08/2026
CVE-2026-63515
Critical
N/D
Out-of-bounds read in Microsoft Office allows an unauthorized attacker to execute code locally. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
11/08/2026
CVE-2026-63518
Critical
N/D
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
11/08/2026
CVE-2026-63519
Critical
N/D
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
11/08/2026
CVE-2026-63522
Critical
N/D
Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to elevate privileges locally. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information. What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain SQL sysadmin privileges.
11/08/2026
CVE-2026-63525
Critical
N/D
Numeric truncation error in Microsoft Office Word allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it. Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
11/08/2026
CVE-2026-63526
Critical
N/D
Stack-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
11/08/2026
CVE-2026-63532
Critical
N/D
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
11/08/2026
CVE-2026-64562
Critical
N/D
N/D
11/08/2026
CVE-2026-64564
Critical
N/D
N/D
11/08/2026
CVE-2026-64565
Critical
N/D
N/D
11/08/2026
CVE-2026-64898
Critical
N/D
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
11/08/2026
CVE-2026-64903
Critical
N/D
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
11/08/2026
CVE-2026-64907
Critical
N/D
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
11/08/2026
CVE-2026-64909
Critical
N/D
Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
11/08/2026
CVE-2026-64910
Critical
N/D
Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it. Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
11/08/2026
CVE-2026-64911
Critical
N/D
Integer overflow or wraparound in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
11/08/2026
CVE-2026-64921
Critical
N/D
Missing authentication for critical function in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network. How could an attacker exploit the vulnerability?
An authenticated attacker with access to the domain could perform remote code execution on the SharePoint server to elevate themselves to SharePoint admin. There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?
Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order. I am running SharePoint Server 2016. Do the updates for SharePoint Enterprise Server 2016 also apply to the version I am running?
Yes. The same KB number applies to both SharePoint Server 2016 and SharePoint Enterprise Server 2016. Customers running either version should install the security update to be protected from this vulnerability.
11/08/2026
CVE-2026-65657
Critical
N/D
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it.
11/08/2026
CVE-2026-65664
Critical
N/D
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it. Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
11/08/2026
CVE-2026-65665
Critical
N/D
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network. How could an attacker exploit the vulnerability?
In a network-based attack, an authenticated attacker, as at least a Site Owner, could write arbitrary code to inject and execute code remotely on the SharePoint Server. There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?
Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order.
11/08/2026
CVE-2026-65667
Critical
N/D
Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
11/08/2026
CVE-2026-65668
Critical
N/D
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
11/08/2026
CVE-2026-65679
Critical
KB5120238
5120238
11/08/2026
CVE-2026-65679
Critical
N/D
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network. How could an attacker exploit this vulnerability?
An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to have a deep understanding of the system. Successful exploitation is not guaranteed and depends on a combination of factors that might include the environment, system configuration, and the presence of additional security measures.
11/08/2026
CVE-2026-65679
Critical
KB5120242
5120242
11/08/2026
CVE-2026-65679
Critical
KB5120229
5120229
11/08/2026
CVE-2026-65679
Critical
KB5120233
5120233
11/08/2026
CVE-2026-65679
Critical
KB5120228
5120228
11/08/2026
CVE-2026-65679
Critical
KB5120418
5120418
11/08/2026
CVE-2026-65679
Critical
KB5120386
5120386
11/08/2026
CVE-2026-65679
Critical
KB5120385
5120385
11/08/2026
CVE-2026-65770
Critical
N/D
Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
11/08/2026
CVE-2026-65789
Critical
KB5120238
5120238
11/08/2026
CVE-2026-65789
Critical
N/D
Use after free in Windows DNS allows an unauthorized attacker to execute code over a network. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Exploitation requires specific conditions, including particular network configurations and timing conditions, and has only been observed in limited scenarios. This means an attacker cannot reliably exploit the issue in all environments and may need favorable setup or circumstances for it to work. How could an attacker exploit this vulnerability?
An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
11/08/2026
CVE-2026-65789
Critical
KB5120242
5120242
11/08/2026
CVE-2026-65789
Critical
KB5120229
5120229
11/08/2026
CVE-2026-65789
Critical
KB5120233
5120233
11/08/2026
CVE-2026-65789
Critical
KB5120228
5120228
11/08/2026
CVE-2026-65789
Critical
KB5120418
5120418
11/08/2026
CVE-2026-65791
Critical
KB5120238
5120238
11/08/2026
CVE-2026-65791
Critical
N/D
Heap-based buffer overflow in Windows iSCSI Target Service allows an unauthorized attacker to execute code over a network. How could an attacker exploit this vulnerability?
An unauthenticated attacker could exploit this vulnerability by sending a specially crafted packet to an affected service over the network. Successful exploitation could allow the attacker to execute code on the target system. No authentication or user interaction is required.
11/08/2026
CVE-2026-65791
Critical
KB5120242
5120242
11/08/2026
CVE-2026-65791
Critical
KB5120229
5120229
11/08/2026
CVE-2026-65791
Critical
KB5120233
5120233
11/08/2026
425
Visitas totales
166
Visitantes únicos