September 2026 CVE archive
Records published in NIST NVD between Sep 1 and Sep 30, 2026 (UTC). Data imported from the NVD CVE API 2.0 and the CISA KEV catalog; each record shows its own source and verification time.
Total records
15,074
Critical
1,387
High
5,790
Medium
4,826
Low
527
Severity not reported
2,544
In CISA KEV
32
Most affected vendors (by CPE data where available): microsoft (995), google (652), oracle (309), apple (245), ibm (229), adobe (213), mozilla (191), dell (185), arubanetworks (100), apache (88)
| CVE | Severity | CVSS | KEV | Vendor / product | Published | Modified |
|---|---|---|---|---|---|---|
| CVE-2026-69396 Use after free in Windows NDIS allows an authorized attacker to elevate privileg... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69389 Heap-based buffer overflow in Windows Storage Management Provider allows an auth... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-25 |
| CVE-2026-69383 External control of file name or path in Windows Shell allows an authorized atta... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69384 Null pointer dereference in Virtual Hard Disk (VHD) Miniport Driver allows an un... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69385 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69386 Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unaut... |
high | 8.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69388 Use after free in Windows Bluetooth Service allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69377 Missing authorization in Windows Modern Device Management (MDM) allows an author... |
high | 7.8 | — | Microsoft / windows 10 1809 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69378 Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attac... |
high | 7.5 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-69379 Improper link resolution before file access ('link following') in Windows NTFS a... |
high | 7.0 | — | Microsoft / windows 11 23h2 | 2026-09-08 | 2026-09-14 |
| CVE-2026-69380 Missing authorization in Microsoft Exchange Server allows an authorized attacker... |
high | 8.1 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-29 |
| CVE-2026-69368 Heap-based buffer overflow in Windows Overlay Filter allows an authorized attack... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69371 Heap-based buffer overflow in Windows Overlay Filter allows an authorized attack... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69362 Use after free in Windows Error Reporting allows an authorized attacker to eleva... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69364 Concurrent execution using shared resource with improper synchronization ('race... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69365 Out-of-bounds read in Microsoft Local Security Authority Server (lsasrv) allows... |
high | 8.0 | — | Microsoft / windows 10 21h2 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69366 Use after free in Windows Kernel allows an authorized attacker to elevate privil... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69357 Use after free in Windows NDIS allows an authorized attacker to elevate privileg... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69358 Use of uninitialized resource in Remote Desktop Client allows an authorized atta... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69359 Heap-based buffer overflow in Active Directory Domain Services allows an authori... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69360 Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attac... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-29 |
| CVE-2026-69352 Heap-based buffer overflow in Windows Biometric Service allows an authorized att... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-11 |
| CVE-2026-69355 External control of file name or path in Microsoft Exchange Server allows an aut... |
high | 8.8 | — | Microsoft / exchange server | 2026-09-08 | 2026-09-30 |
| CVE-2026-69346 Heap-based buffer overflow in Windows Print Spooler Components allows an authori... |
high | 8.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69347 Heap-based buffer overflow in Windows Fast FAT Driver allows an unauthorized att... |
high | 7.4 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69348 Heap-based buffer overflow in Windows Win32K allows an authorized attacker to el... |
high | 7.8 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69337 Double free in Windows Registry allows an authorized attacker to elevate privile... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69338 Use after free in Remote Desktop Gateway Service allows an authorized attacker t... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69340 Heap-based buffer overflow in Windows NTFS allows an authorized attacker to elev... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69341 Use after free in Windows Image Acquisition allows an authorized attacker to ele... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69342 Out-of-bounds read in Windows DHCP Server allows an unauthorized attacker to den... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69333 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 11 24h2 | 2026-09-08 | 2026-09-17 |
| CVE-2026-69334 Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an... |
high | 8.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69335 Use after free in Windows Win32K allows an authorized attacker to elevate privil... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69336 Heap-based buffer overflow in Microsoft Standard XPS allows an authorized attack... |
high | 7.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69324 Access of resource using incompatible type ('type confusion') in Windows Perform... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69325 Heap-based buffer overflow in Microsoft JScript allows an unauthorized attacker... |
high | 8.1 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69328 Untrusted search path in Windows Storage allows an authorized attacker to elevat... |
high | 7.8 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
| CVE-2026-69329 Out-of-bounds read in BranchCache allows an unauthorized attacker to deny servic... |
high | 7.5 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-30 |
| CVE-2026-69331 Use after free in Windows Remote Access Connection Manager allows an authorized... |
high | 7.0 | — | Microsoft / windows 10 1607 | 2026-09-08 | 2026-09-24 |
Sources: NIST NVD (CVE API 2.0) and the CISA KEV catalog. Severity is as stated by the source; missing values are shown as “not reported”, never estimated.