CVE-2026-108444 Microsoft Office Remote Code Execution Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108445 Microsoft Office Word Remote Code Execution Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108446 Microsoft Office Excel Remote Code Execution Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108447 Microsoft Office Word Remote Code Execution Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108448 Microsoft Office Outlook Remote Code Execution Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108449 Microsoft Office Word Remote Code Execution Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108450 Microsoft Office Word Remote Code Execution Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108451 Microsoft Office Word Remote Code Execution Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108452 Microsoft Office SharePoint Remote Code Execution Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108453 Microsoft Office PowerPoint Information Disclosure Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108454 Microsoft Office PowerPoint Information Disclosure Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-108455 Microsoft Office PowerPoint Information Disclosure Vulnerability
Information published. This CVE was addressed by updates that were released in October 2026, but the CVE was inadvertently omitted from the October 2026 Security Updates. This is an informational change only. Customers who have already installed the October 2026 updates do not need to take any further action.
Categories: Microsoft
CVE-2026-109468 ASP.NET Core Denial of Service Vulnerability
Allocation of resources without limits or throttling in ASP.NET Core allows an unauthorized attacker to deny service over a network.
Categories: Microsoft
CVE-2026-109461 Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
Categories: Microsoft
CVE-2026-80092 Microsoft Identity Web Elevation of Privilege Vulnerability
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
Categories: Microsoft
CVE-2026-32176 SQL Server Elevation of Privilege Vulnerability
Added SQL software to the Security Updates table. Customers that are running supported version of SQL are encouraged to update to the indicated version to be protected from this vulnerability.
Categories: Microsoft
CVE-2026-102849 Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Categories: Microsoft
CVE-2026-102850 Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
Categories: Microsoft
CVE-2026-103572 Visual Studio Tools for Applications and SQL Server Management Studio Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Visual Studio Tools for Applications and SQL Server Management Studio allows an unauthorized attacker to execute code over a network.
Categories: Microsoft
ADV260001 ADV260001 Hardening changes for ReFS volumes on removable media
Starting with Windows updates released on and after October 13, 2026, Microsoft is making hardening changes to the [Resilient File System (ReFS)](https://learn.microsoft.com/windows-server/storage/refs/refs-overview). This change is not enable by default until 2027. Please see [Hardening changes for ReFS volumes on removable media](https://support.microsoft.com/en-us/servicing/os/windows/docs/2026/10/hardening-changes-for-refs-volumes-on-removable-media) for more information.
Categories: Microsoft