Windows

Summary A path traversal vulnerability in Windows PowerShell allows an unauthenticated attacker to bypass path validation safeguards over a network. Successful exploitation circumvents the security checks that restrict which files may be modified and that require user approval for sensitive locations, allowing changes to protected files without the user’s knowledge or consent. The attack requires user interaction but no authentication. The impact is limited to integrity — an attacker can modify protected files but cannot read arbitrary files or cause denial of service through this vulnerability alone. ...

Summary A race condition in the Windows Print Spooler service leads to a use-after-free that allows an authenticated attacker to escalate privileges to SYSTEM. The vulnerability requires the attacker to win a race during spooler component processing, but successful exploitation grants full control of the affected system. Microsoft rates exploitation as More Likely on newer Windows versions. This vulnerability was discovered by Aretiq AI and responsibly disclosed to Microsoft, who addressed it in the September 2026 Patch Tuesday security updates. Microsoft has credited ECooper with Aretiq.AI for reporting this vulnerability in their security advisory. ...