Microsoft

Information published. This CVE was addressed by updates that were released in May 2026, but the CVE was inadvertently omitted from the May 2026 Security Updates. This is an informational change only. Customers who have already installed the May 2026 updates do not need to take any further action.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Protection mechanism failure in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

Advisory updated to announce new versions of Servicing Stack Updates are available. Please see the FAQ for details.

Improper access control in Microsoft PC Manager allows an authorized attacker to bypass a security feature locally.

Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

Deserialization of untrusted data in Nuance PowerScribe allows an unauthorized attacker to execute code over a network.

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.

Buffer over-read in Windows Projected File System Filter Driver allows an authorized attacker to elevate privileges locally.

Improper access control in Windows Administrator Protection allows an authorized attacker to bypass a security feature locally.

Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.

Improper input validation in Visual Studio Code allows an unauthorized attacker to elevate privileges over a network.

Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information over a network.