Microsoft
CVE-2026-50522: SharePoint unauthenticated remote code execution
Microsoft's SharePoint deserialization advisory conflicts on authentication prerequisites: its description says unauthenticated, while its FAQ requires Site Owner access. CISA lists exploitation; update affected farms and preserve evidence without resolving that conflict by assumption.
CVE-2026-58644: SharePoint unauthenticated deserialization RCE
Microsoft reports exploitation of this SharePoint deserialization flaw but gives conflicting authentication prerequisites. Use its CVE-specific edition mapping across the farm; neither another SharePoint fix nor the narrower FAQ establishes this exposure is resolved.
CVE-2026-56164: SharePoint missing-authentication privilege escalation
Missing authentication in SharePoint can let an unauthorized network attacker elevate privileges. Microsoft's Moderate severity does not negate reported exploitation; update every applicable farm server and review authentication, IIS and role-change evidence.
CVE-2026-56155: AD FS local privilege escalation
An authorized local attacker can exploit AD FS access controls to gain administrator privileges. Match each federation node to its Windows update; patch completion alone cannot establish that identity-service credentials and trusts remain safe.
CVE-2019-1068: SQL Server remote code execution
An authenticated attacker can use a crafted SQL query to execute code as the SQL Server Database Engine service account. Match the service pack and GDR or CU branch; CISA now lists the flaw as exploited.
CVE-2026-55040: SharePoint authentication bypass
SharePoint's authentication bypass can permit unauthenticated user impersonation. CISA's later exploitation listing differs from Microsoft's original assessment; update every affected on-premises farm server and preserve web, authentication and audit evidence.
CVE-2026-33824: Windows IKEv2 remote code execution
An unauthenticated attacker can send crafted packets to IKEv2-enabled Windows systems and potentially execute code. CISA lists exploitation; match the Windows update branch and assess VPN disruption before applying the documented network restrictions.
CVE-2026-68820: Windows WinSock AFD local privilege escalation
A locally authenticated attacker who wins a race in Windows WinSock AFD can gain SYSTEM privileges. Microsoft and CISA report exploitation; confirm the applicable update and investigate suspicious endpoint privilege transitions separately.
CVE-2026-85880: Windows ALPC local privilege escalation
This exploited Windows ALPC flaw lets code in a low-privilege AppContainer escape to SYSTEM. Match the host's release and architecture to its security update; patch completion does not exclude earlier endpoint compromise.
CVE-2026-81963: Windows Update Stack privilege escalation to SYSTEM
An exploited Windows Update Stack flaw can elevate a local attacker to SYSTEM. Match the Windows release to its verified KB and build, then investigate suspicious endpoint activity separately from confirming the update.