Consulta vulnerabilidades CVE, conoce su impacto y verifica las medidas de corrección en fuentes oficiales.
CVE
Riesgo
KB asociado
Descripcion del KB
Fecha de liberacion
CVE-2026-44815
Critical
KB5094128
5094128
09/06/2026
CVE-2026-44815
Critical
KB5094127
5094127
09/06/2026
CVE-2026-44815
Critical
KB5094125
5094125
09/06/2026
CVE-2026-44815
Critical
KB5094126
5094126
09/06/2026
CVE-2026-44815
Critical
KB5093998
5093998
09/06/2026
CVE-2026-44815
Critical
KB5095051
5095051
09/06/2026
CVE-2026-44815
Critical
KB5094122
5094122
09/06/2026
CVE-2026-44815
Critical
KB5094042
5094042
09/06/2026
CVE-2026-44815
Critical
KB5094041
5094041
09/06/2026
CVE-2026-45456
Critical
N/D
Access of resource using incompatible type ('type confusion') in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?
Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order. Why is Microsoft Word listed in the Security Updates table but the title indicates that Outlook is affected?
This vulnerability can be exploited when rendering email in Outlook (classic). The rendering of email in Outlook (classic) uses Microsoft Word functionality. The vulnerability is in the Word functionality and is exploitable through Outlook (classic). Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. Are the updates for Microsoft Office LTSC for Mac 2021 and 2024 currently available?
Yes. As of June 16, 2025, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability.
09/06/2026
CVE-2026-45458
Critical
N/D
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. There are multiple update packages available for some of the affected software. Do I need to install all the updates listed in the Security Updates table for the software?
Yes. Customers should apply all updates offered for the software installed on their systems. If multiple updates apply, they can be installed in any order. Why is Microsoft Word listed in the Security Updates table but the title indicates that Outlook is affected?
This vulnerability can be exploited when rendering email in Outlook (classic). The rendering of email in Outlook (classic) uses Microsoft Word functionality. The vulnerability is in the Word functionality and is exploitable through Outlook (classic). Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. Are the updates for Microsoft Office LTSC for Mac 2021 and 2024 currently available?
Yes. As of June 16, 2025, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability.
09/06/2026
CVE-2026-45460
Critical
N/D
Buffer over-read in Microsoft Office allows an unauthorized attacker to disclose information locally. What type of information could be disclosed by this vulnerability?
An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. Are the updates for Microsoft Office LTSC for Mac 2021 and 2024 currently available?
Yes. As of June 16, 2025, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability. Are the updates for Microsoft Office for Android currently available?
Yes. As of June 15, 2026, the security update for Microsoft Office for Android are available. Customers running Microsoft Office for Android should ensure the update is installed to be protected from this vulnerability.
09/06/2026
CVE-2026-45461
Critical
N/D
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. Are the updates for Microsoft Office LTSC for Mac 2021 and 2024 currently available?
Yes. As of June 16, 2025, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability. Are the updates for Microsoft Office for Android currently available?
Yes. As of June 15, 2026, the security update for Microsoft Office for Android are available. Customers running Microsoft Office for Android should ensure the update is installed to be protected from this vulnerability.
09/06/2026
CVE-2026-45463
Critical
N/D
Integer underflow (wrap or wraparound) in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. Are the updates for Microsoft Office LTSC for Mac 2021 and 2024 currently available?
Yes. As of June 16, 2025, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability. Are the updates for Microsoft Office for Android currently available?
Yes. As of June 15, 2026, the security update for Microsoft Office for Android are available. Customers running Microsoft Office for Android should ensure the update is installed to be protected from this vulnerability.
09/06/2026
CVE-2026-45472
Critical
N/D
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Are the updates for Microsoft Office LTSC for Mac 2021 and 2024 currently available?
Yes. As of June 16, 2025, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability. Are the updates for Microsoft Office for Android currently available?
Yes. As of June 15, 2026, the security update for Microsoft Office for Android are available. Customers running Microsoft Office for Android should ensure the update is installed to be protected from this vulnerability.
09/06/2026
CVE-2026-45474
Critical
N/D
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector. Are the updates for Microsoft Office LTSC for Mac 2021 and 2024 currently available?
Yes. As of June 16, 2025, the security update for Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac are available. Customers running Microsoft Office LTSC for Mac 2021, 2024 and Microsoft Office 365 for Mac should ensure the update is installed to be protected from this vulnerability. Are the updates for Microsoft Office for Android currently available?
Yes. As of June 15, 2026, the security update for Microsoft Office for Android are available. Customers running Microsoft Office for Android should ensure the update is installed to be protected from this vulnerability.
09/06/2026
CVE-2026-45476
Critical
N/D
Use after free in Linux MANA Driver allows an authorized attacker to elevate privileges locally. What do I have to do to protect myself from this vulnerability?
To help protect your systems from this vulnerability, update your Linux kernel to a version that includes the upstream fix for this issue. The fix has already been accepted upstream and will be included in newer kernel releases.
If your environment uses a Linux distribution that has not yet incorporated the updated kernel version, you should monitor your distribution vendor’s security advisories and apply the appropriate security update as soon as it becomes available. Some distributions may release the fix immediately through security updates, while others may include it in a future kernel package or maintenance release.
Organizations that maintain custom kernels or remain on older kernel branches may need to manually backport or apply the upstream patch according to their standard patch management and validation processes.
As a general best practice, ensure systems are regularly updated with the latest security patches and kernel releases provided by your operating system vendor. What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could gain ELEVATED privileges, which may allow them to perform actions beyond their original permissions. According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities. How could an attacker exploit the vulnerability?
An attacker who already has control of the host environment could trigger a flaw in the guest driver that mishandles memory. This could allow the attacker to read sensitive information from the guest and potentially use that access to gain higher privileges within the guest system.
09/06/2026
CVE-2026-45480
Critical
N/D
Improper authentication in Azure Active Directory allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
09/06/2026
CVE-2026-45497
Critical
N/D
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
09/06/2026
CVE-2026-45607
Critical
KB5094123
5094123
09/06/2026
CVE-2026-45607
Critical
N/D
Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally. How could an attacker exploit this vulnerability?
This vulnerability would require an authenticated attacker on a guest VM to send specially crafted file operation requests on the VM to hardware resources on the VM which could result in remote code execution on the host server. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.
09/06/2026
CVE-2026-45607
Critical
KB5094128
5094128
09/06/2026
CVE-2026-45607
Critical
KB5094127
5094127
09/06/2026
CVE-2026-45607
Critical
KB5094125
5094125
09/06/2026
CVE-2026-45607
Critical
KB5094126
5094126
09/06/2026
CVE-2026-45607
Critical
KB5093998
5093998
09/06/2026
CVE-2026-45607
Critical
KB5095051
5095051
09/06/2026
CVE-2026-45607
Critical
KB5094122
5094122
09/06/2026
CVE-2026-45641
Critical
KB5094128
5094128
09/06/2026
CVE-2026-45641
Critical
N/D
Access of resource using incompatible type ('type confusion') in Windows Hyper-V allows an unauthorized attacker to execute code locally. How could an attacker exploit this vulnerability?
This vulnerability would require an authenticated attacker on a guest VM to send specially crafted file operation requests on the VM to hardware resources on the VM which could result in remote code execution on the host server. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.
09/06/2026
CVE-2026-45641
Critical
KB5094127
5094127
09/06/2026
CVE-2026-45641
Critical
KB5094125
5094125
09/06/2026
CVE-2026-45641
Critical
KB5094126
5094126
09/06/2026
CVE-2026-45641
Critical
KB5093998
5093998
09/06/2026
CVE-2026-45641
Critical
KB5095051
5095051
09/06/2026
CVE-2026-45648
Critical
KB5094128
5094128
09/06/2026
CVE-2026-45648
Critical
N/D
5094125
09/06/2026
CVE-2026-45648
Critical
KB5094125
5094125
09/06/2026
CVE-2026-45657
Critical
KB5094128
5094128
09/06/2026
CVE-2026-45657
Critical
N/D
Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network. How could an attacker exploit the vulnerability?
An attacker could exploit this vulnerability by sending specially crafted network traffic to a vulnerable Windows system. If successful, the malicious network packets could trigger a flaw in how the Windows kernel processes certain TCP/IP data, potentially allowing the attacker to run code with system-level privileges without needing to sign in or interact with a user.
09/06/2026
CVE-2026-45657
Critical
KB5094125
5094125
09/06/2026
CVE-2026-45657
Critical
KB5094126
5094126
09/06/2026
CVE-2026-45657
Critical
KB5093998
5093998
09/06/2026
CVE-2026-45657
Critical
KB5095051
5095051
09/06/2026
CVE-2026-47288
Critical
KB5094123
5094123
09/06/2026
CVE-2026-47288
Critical
N/D
Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network. How could an attacker exploit this vulnerability?
An attacker who is already authenticated to the domain could send specially crafted authentication-related data to a domain controller, causing the affected Windows component to incorrectly handle memory. This could allow the attacker to disrupt the service or gain higher privileges on the domain controller without any user interaction. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.
09/06/2026
CVE-2026-47288
Critical
KB5094128
5094128
09/06/2026
CVE-2026-47288
Critical
KB5094125
5094125
09/06/2026
CVE-2026-47288
Critical
KB5094122
5094122
09/06/2026
CVE-2026-47288
Critical
KB5094042
5094042
09/06/2026
410
Visitas totales
164
Visitantes únicos