CYBERSECURITYTRACKER
TRACKING6,506 stories in this site build1,309 vulnerability news stories in this site build
Patch Day month

September 2026 vulnerabilities

Microsoft reports 2 vulnerabilities with exploitation detected in the wild this month. This defender-focused view covers 2,269 vulnerabilities across 4,267 returned patch records from 4 vendors. Filter the month to date, or browse the static page trail without JavaScript.

4,267all patch recordsClear filters229criticalShow these records2Microsoft exploitation detectedShow these records4Microsoft in the Known Exploited Vulnerabilities catalogShow these records1,579tracked hereShow these records
Patch records
Returned Microsoft and cross-vendor release records. One Common Vulnerabilities and Exposures (CVE) identifier can appear in more than one record.
Tracked here
Records joined to a vulnerability record in this tracker.
Defender priority
Sorts Microsoft exploitation status, Cybersecurity and Infrastructure Security Agency (CISA) Known Exploited Vulnerabilities (KEV) catalog status, severity, and tracker coverage first.
More likely
Microsoft's Exploitability Index rating that exploitation is more likely. It is not a claim that exploitation was detected.
Red Hat 2,756Microsoft 1,228Android 271Cisco 12

Narrow the complete month

Filters use every patch record in this month, including records on later static pages.

Clear all

Microsoft-only signal filters exclude records without Microsoft signal data as unknown, report them separately, and never count them as “no.” “Tracked here” covers both Microsoft and cross-vendor records.

Loading the complete-month filter index…

An Exploit Prediction Scoring System (EPSS) percentage is the global 30-day exploitation probability in the wild, not specific to you. Do not read it as a complete risk score or as evidence about your environment or impact.

Page 22 of 22 · records 4,201 to 4,267 of 4,267

Microsoft Security Response Center

CVEDateProductMSRC severityOut-of-bandEPSSTitle
CVE-2026-80761 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailableBluetooth: ISO: zero the sockaddr before returning it in getname
CVE-2026-80892 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailableerofs: cap LZMA stream pool size
CVE-2026-80910 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailableASoC: codecs: lpass-wsa-macro: Fix enum kcontrol accesses
CVE-2026-80797 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailablenfc: pn533: purge fragmented skbs during cleanup
CVE-2026-80889 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailablecan: isotp: fix timer drain order, wakeup handling and tx_gen ordering
CVE-2026-86137 ↗azl3 libxml2 2.11.5-10 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailableIn libxml2 before 2.15.4, xmlFAParsePosCharGroup has an out-of-bounds read, aka an out-of-bounds read in the NXT macro in xmlregexp.
CVE-2026-80843 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailablexfrm: fix xfrm_state_construct() auth-trunc leak
CVE-2026-86141 ↗azl3 libxml2 2.11.5-10 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailablexmlregexp in libxml2 before 2.15.4 has a NULL pointer dereference in xmlRegNewParserCtxt after a strdup failure, i.e., it does not calculate a string length after NULL checking.
CVE-2026-80744 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailablenetfilter: nf_tables_offload: suppress WARN_ON_ONCE for ENOMEM in abort path
CVE-2026-18743 ↗azl3 popt 1.19-1 on Azure Linux 3.0LowOut-of-bandNot availableMicrosoft rating unavailablePopt-devel: popt-static: short realloc in poptconfigfiletostring
CVE-2026-76023 ↗Microsoft Edge (Chromium-based)N/AOut-of-bandNot availableMicrosoft rating unavailableChromium CVE-2026-76023: Improper resource control in Linux Toolkit Theming
CVE-2026-76022 ↗Microsoft Edge (Chromium-based)N/AOut-of-bandNot availableMicrosoft rating unavailableChromium CVE-2026-76022: Buffer overflow in Network
CVE-2026-76021 ↗Microsoft Edge (Chromium-based)N/AOut-of-bandNot availableMicrosoft rating unavailableChromium CVE-2026-76021: Use after free in DOM
CVE-2026-76019 ↗Microsoft Edge (Chromium-based)N/AOut-of-bandNot availableMicrosoft rating unavailableChromium CVE-2026-76019: Incorrect authorization in Workers
CVE-2026-76018 ↗Microsoft Edge (Chromium-based)N/AOut-of-bandNot availableMicrosoft rating unavailableChromium CVE-2026-76018: Privilege elevation in Import
CVE-2026-76017 ↗Microsoft Edge (Chromium-based)N/AOut-of-bandNot availableMicrosoft rating unavailableChromium CVE-2026-76017: Use after free in Chromoting
CVE-2026-76039 ↗Microsoft Edge (Chromium-based)N/AOut-of-bandNot availableMicrosoft rating unavailableChromium CVE-2026-76039: Incorrect reference resolution in Core
CVE-2026-76036 ↗Microsoft Edge (Chromium-based)N/AOut-of-band1%Microsoft rating unavailableChromium CVE-2026-76036: Buffer overflow in Dawn
CVE-2026-85053 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium CVE-2026-85053: Improper resource exposure in CacheStorage
CVE-2026-85052 ↗Microsoft Edge (Chromium-based)N/AOut-of-bandNot availableMicrosoft rating unavailableChromium CVE-2026-85052: Out of bounds read in CrashReporting
CVE-2026-85051 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium CVE-2026-85051: Type confusion in Compositing
CVE-2026-85049 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium CVE-2026-85049: Use after free in Skia
CVE-2026-85048 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium CVE-2026-85048: Use after free in Compositing
CVE-2026-85045 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium CVE-2026-85045: Race condition in V8
CVE-2026-85043 ↗Microsoft Edge (Chromium-based)N/AOut-of-bandNot availableMicrosoft rating unavailableChromium CVE-2026-85043: Incomplete cleanup in Network
CVE-2026-85042 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium CVE-2026-85042: Use after free in DevTools
CVE-2026-84333 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-84333 Use after free in Dawn
CVE-2026-84330 ↗Microsoft Edge (Chromium-based)N/AOut-of-bandNot availableMicrosoft rating unavailableChromium: CVE-2026-84330 UI misrepresentation in FullScreen
CVE-2026-84352 ↗Microsoft Edge (Chromium-based)N/AOut-of-band0%Microsoft rating unavailableChromium: CVE-2026-84352 Use after free in WebGL
CVE-2026-85892 ↗Not reportedN/AOut-of-bandNot availableMicrosoft rates: Exploitation Less LikelyMicrosoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2026-84323 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84323 Missing authorization in FileSystem
CVE-2026-84324 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84324 Use after free in Proxy
CVE-2026-84325 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84325 Improper input validation in DataTransfer
CVE-2026-84326 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84326 Uninitialized resource in V8
CVE-2026-84327 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84327 Incorrect authorization in Autofill
CVE-2026-84328 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84328 Missing authorization in FileSystem
CVE-2026-84329 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84329 Confused deputy in CredentialProvider
CVE-2026-84331 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84331 Incorrect authorization in Actor
CVE-2026-84332 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84332 Incorrect authorization in SiteSettings
CVE-2026-84334 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84334 Incorrect authorization in Chromoting
CVE-2026-84335 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84335 Incorrect authorization in TabStrip
CVE-2026-84347 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84347 Use after free in WebRTC
CVE-2026-84348 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84348 Information leak in MediaCapture
CVE-2026-84349 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84349 Use after free in Browser
CVE-2026-84350 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84350 Use after free in TabStrip
CVE-2026-84351 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84351 Buffer overflow in GPU
CVE-2026-84353 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84353 Use after free in Shared Tab Groups
CVE-2026-84354 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84354 Incorrect authorization in FileSystem
CVE-2026-84355 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84355 Incorrect authorization in Navigation
CVE-2026-84356 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84356 UI misrepresentation in FullScreen
CVE-2026-84357 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84357 Improper input validation in Omnibox
CVE-2026-84358 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84358 Improper privilege management in Downloads
CVE-2026-84359 ↗Microsoft Edge (Chromium-based)N/A0%Microsoft rating unavailable1 mentionsChromium: CVE-2026-84359 Information leak in Skia
CVE-2026-80822 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailablemailbox: mchp-ipc-sbi: Add null check for devm_kasprintf()
CVE-2026-80901 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailableipvs: fix the checksum validations
CVE-2026-80887 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailabledrm/vmwgfx: use check_add_overflow for shader size+offset bound
CVE-2026-80883 ↗azl3 kernel 6.6.150.1-1 on Azure Linux 3.0N/AOut-of-bandNot availableMicrosoft rating unavailabledrm/tegra: gr2d/gr3d: Initialize address register map before HOST1X client is registered

Cross-vendor patches

VendorCVESeverityProductFixed versionPatchAdvisory
Red HatCVE-2026-86137CVSS 2.9Red Hat Hardened Imageslibxml2-main@aarch64Patch ↗Advisory ↗
Red HatCVE-2026-86141CVSS 2.9Red Hat Hardened Imageslibxml2-main@aarch64Patch ↗Advisory ↗
Red HatCVE-2026-54891CVSS 3.7Red Hat Hardened Imageserlang27-main@aarch64Patch ↗Advisory ↗
Red HatCVE-2026-65183CVSS 2.5Red Hat Hardened Imagestomcat10-main@noarchPatch ↗Advisory ↗
Red HatCVE-2026-66422CVSS 2.7Red Hat Hardened Imagestomcat10-main@noarchPatch ↗Advisory ↗
Red HatCVE-2026-82562CVSS 3.7Red Hat Hardened Imagesgrafana13-2-main@aarch64Patch ↗Advisory ↗
Red HatCVE-2026-82562CVSS 3.7Red Hat Hardened Imagesgrafana13-1-main@aarch64Patch ↗Advisory ↗
Red HatCVE-2025-59436CVSS 3.2Red Hat Ceph Storage 8.1registry.redhat.io/rhceph/rhceph-8-rhel9@sha256:070f43995aae0152eac7d228ae7d4d005eb57e06e14aef1b50d4db64341b826a_arm64Patch ↗Advisory ↗
Red HatCVE-2026-59846CVSS 3.9Red Hat Enterprise Linux AppStream (v. 9)libssh-debuginfo-0:0.10.4-19.el9_8.aarch64Patch ↗Advisory ↗
Red HatCVE-2026-59846CVSS 3.9Red Hat Enterprise Linux AppStream (v. 8)libssh-debuginfo-0:0.9.6-17.el8_10.aarch64Patch ↗Advisory ↗

Glossary

Open in glossary