Microsoft

Summary A path traversal vulnerability in Windows PowerShell allows an unauthenticated attacker to bypass path validation safeguards over a network. Successful exploitation circumvents the security checks that restrict which files may be modified and that require user approval for sensitive locations, allowing changes to protected files without the user’s knowledge or consent. The attack requires user interaction but no authentication. The impact is limited to integrity — an attacker can modify protected files but cannot read arbitrary files or cause denial of service through this vulnerability alone. ...

Summary A race condition in the Windows Print Spooler service leads to a use-after-free that allows an authenticated attacker to escalate privileges to SYSTEM. The vulnerability requires the attacker to win a race during spooler component processing, but successful exploitation grants full control of the affected system. Microsoft rates exploitation as More Likely on newer Windows versions. This vulnerability was discovered by Aretiq AI and responsibly disclosed to Microsoft, who addressed it in the September 2026 Patch Tuesday security updates. Microsoft has credited ECooper with Aretiq.AI for reporting this vulnerability in their security advisory. ...

Summary A deserialization of untrusted data vulnerability in Microsoft Exchange Server allows any user with a mailbox account to crash the server repeatedly, causing sustained denial of service across the entire organization. The only prerequisite is a valid email account on the target Exchange server — no administrative privileges or special roles are required. The vulnerability was reported as a denial of service; however, the underlying deserialization primitive may carry remote code execution potential given the right gadget chain. No RCE gadget was identified during our research. ...

1. Overview A server-side request forgery (SSRF) vulnerability exists in Microsoft Exchange Server’s Exchange Web Services (EWS) InstallApp operation. When an authenticated user submits a ManifestUrl parameter via the InstallApp SOAP request, Exchange downloads the manifest from the supplied URL. The intranet address check that prevents SSRF is gated on the isBposUser flag, which is false for all on-premises Exchange deployments. This means the check is bypassed entirely in non-cloud environments, allowing an authenticated user to force the Exchange server to make HTTP requests to arbitrary internal or external URLs. Microsoft addressed this vulnerability in the June 2026 security update (KB5094139). ...