DeutschShown in its original language — a full translation is planned for a future version.
Microsoft Apps: Mehrere Schwachstellen
view advisory published 2026-10-13
Ein Angreifer kann mehrere Schwachstellen in Microsoft PowerToys, Microsoft Power Apps und Microsoft Apps ausnutzen, um erweiterte Berechtigungen – einschließlich Administratorrechte – zu erlangen, beliebigen Code auszuführen, Daten zu manipulieren oder einen Denial-of-Service-Zustand auszulösen.
01
describes (6)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-92707US | — | — | ||
MessagePack for C# is a MessagePack serializer for C#. Prior to 2.5.303 and 3.1.9, deserializing attacker-controlled MessagePack data as System.Object through PrimitiveObjectFormat… | ||||
| CVE-2026-96188US | high7.3 | — | ||
External control of system or configuration setting in Microsoft PowerToys allows an authorized attacker to elevate privileges locally. | ||||
| CVE-2026-83844US | high8.1 | — | ||
Out-of-bounds read in Windows Paint allows an unauthorized attacker to execute code over a network. | ||||
| CVE-2026-83681US | medium5.5 | — | ||
Weak authentication in Microsoft PowerToys allows an authorized attacker to perform tampering locally. | ||||
| CVE-2026-70213US | high8.0 | — | ||
Origin validation error in Microsoft Power Apps allows an authorized attacker to execute code over a network. | ||||
| CVE-2026-94510US | critical9.9 | — | ||
Authorization bypass through user-controlled key in Microsoft Bookings allows an unauthorized attacker to elevate privileges over a network. | ||||
02
references
External citations — patches, advisories, analysis.
- Microsoft Leitfaden für Sicherheitsupdatesexternal
- Microsoft Security Advisory CVE-2026-70213external
- Microsoft Security Advisory CVE-2026-83681external
- Microsoft Security Advisory CVE-2026-83844external
- Microsoft Security Advisory CVE-2026-92707external
- Microsoft Security Advisory CVE-2026-94510external
- Microsoft Security Advisory CVE-2026-96188external
- WID-SEC-W-2026-3922 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan