Microsoft
CVE-2026-42897: Exchange Outlook Web Access cross-site scripting
Crafted email can trigger JavaScript in an Exchange OWA user's browser under the stated interaction conditions, not code execution on the server. Verify applicable July security updates before removing mitigation; IE-mode clients lack the required protection.
CVE-2026-32202: Windows Shell spoofing vulnerability
Windows Shell spoofing requires the victim to execute a malicious file and can expose some sensitive information. Microsoft's July re-release requires revised updates; April-only patch evidence does not establish comprehensive remediation.
CVE-2026-33825: Microsoft Defender local privilege escalation
Defender access-control weaknesses can let an authorized local attacker gain SYSTEM privileges. Verify the Antimalware Platform update and investigate suspicious endpoint activity; CISA's later exploitation listing supersedes the original no-exploitation assessment.
CVE-2026-45498: Microsoft Defender local denial of service
The exploited Microsoft Defender flaw can interrupt protection through denial of service. Verify the Antimalware Platform update on each endpoint and examine Defender health telemetry; a currently healthy service does not rule out earlier disruption.
CVE-2026-41091: Microsoft Malware Protection Engine privilege escalation
A link-following flaw in Microsoft Malware Protection Engine can let an authorized local attacker gain SYSTEM privileges. Verify the installed engine update and review endpoint telemetry; this is not unauthenticated remote takeover.
CVE-2010-0806: Legacy Internet Explorer use-after-free RCE
Crafted content viewed in affected legacy Internet Explorer versions can run code with the user's rights. MS10-018 documents the historical fix; it does not restore support, so surviving unsupported browser and platform combinations require retirement.
CVE-2010-0249: Legacy Internet Explorer use-after-free RCE
CVE-2010-0249 can execute code through crafted web content in legacy Internet Explorer. Microsoft's original bulletin reported limited attacks; the 2026 KEV addition is separate history, not a new disclosure or justification for retaining unsupported systems.
CVE-2009-1537: Legacy DirectShow QuickTime parsing RCE
Crafted media can exploit Microsoft's legacy DirectShow QuickTime parser and run code with the user's rights. This is not blanket exposure of Apple's QuickTime application; match the historical Windows component and replace unsupported systems.
CVE-2008-4250: Legacy Windows Server Service RPC remote code execution
The legacy Windows Server Service RPC flaw permits unauthenticated code execution on Windows 2000, XP and Server 2003; Vista and Server 2008 require authentication. Historical patching does not replace retirement or investigation of unsupported assets.
CVE-2026-45659: SharePoint authenticated remote code execution
SharePoint code execution requires an authenticated attacker with at least Site Member permissions. CISA records ransomware-campaign use; apply edition-specific farm updates and preserve membership, IIS and endpoint evidence without assuming this farm was compromised.