Windows & Mac vulnerability log

Exploited in real attacks

Patch now

6 of the last 90 days' Windows and macOS vulnerabilities have been exploited, according to Microsoft, Apple or CISA. If a machine is missing the fix for any of these, it is the first job.

• Patch nowWindowsOctober 13, 2026

  CVE-2026-96951Windows Shell

  Security Feature Bypass · Severity Important · CVSS 8.8 · EPSS 0.02

  In Windows Shell, an attacker with no account could get around a Windows security protection over the network, but only if someone opens a file, link or message. Microsoft severity Important, CVSS 8.8. Microsoft reports it has been exploited in real attacks. CISA lists it as a Known Exploited Vulnerability, meaning attacks have been seen (added 2026-10-13; federal agencies must fix it by 2026-10-16). EPSS score 0.02, the modelled probability of exploitation activity in the next 30 days. Fixed in the October 2026 Windows security update (KB5126646, KB5126651, KB5126653) for 30 supported Windows versions; a restart is required.

  Microsoft advisory NVD record

• Patch nowWindowsOctober 6, 2026

  CVE-2026-81963Windows Update Stack

  Elevation of Privilege · Severity Important · CVSS 7.8 · Fixed earlier (September 2026)

  In Windows Update Stack, an attacker with an ordinary user account could take higher privileges once they can run code on the PC. Microsoft severity Important, CVSS 7.8. Microsoft reports it has been exploited in real attacks. CISA lists it as a Known Exploited Vulnerability, meaning attacks have been seen (added 2026-09-08; federal agencies must fix it by 2026-09-22). Microsoft disclosed it on October 6, 2026, but the fix had already shipped in the September 2026 Windows security update (KB5122871, KB5122880, KB5124008) for 10 supported Windows versions; a restart is required.

  Microsoft advisory NVD record

• Patch nowMacSeptember 28, 2026

  CVE-2026-86950CoreGraphics

  EPSS 0.01

  In CoreGraphics: Processing a maliciously crafted file may lead to arbitrary code execution. Apple is aware of a report that this issue may have been exploited in an extremely sophisticated attack against specific targeted individuals on versions of iOS before iOS 27. Apple's fix: An out-of-bounds write issue was addressed with improved bounds checking. Apple reports it has been exploited in real attacks. CISA lists it as a Known Exploited Vulnerability, meaning attacks have been seen (added 2026-09-29; federal agencies must fix it by 2026-10-13). EPSS score 0.01, the modelled probability of exploitation activity in the next 30 days. Fixed in macOS Tahoe 26.7.1 and macOS Sequoia 15.8.1.

  Apple release notes NVD record

• Patch nowWindowsSeptember 8, 2026

  CVE-2026-85880Windows Advanced Local Procedure Call (ALPC)

  Elevation of Privilege · Severity Important · CVSS 7.8 · EPSS 0.04

  In Windows Advanced Local Procedure Call (ALPC), an attacker with an ordinary user account could take higher privileges once they can run code on the PC. Microsoft severity Important, CVSS 7.8. Microsoft reports it has been exploited in real attacks. CISA lists it as a Known Exploited Vulnerability, meaning attacks have been seen (added 2026-09-08; federal agencies must fix it by 2026-09-22). EPSS score 0.04, the modelled probability of exploitation activity in the next 30 days. Fixed in the September 2026 Windows security update (KB5122876, KB5122878, KB5122882) for 20 supported Windows versions; a restart is required.

  Microsoft advisory NVD record

• Patch nowWindowsAugust 11, 2026

  CVE-2026-68820Windows Ancillary Function Driver for WinSock

  Elevation of Privilege · Severity Important · CVSS 7

  In Windows Ancillary Function Driver for WinSock, an attacker with an ordinary user account could take higher privileges once they can run code on the PC. Microsoft severity Important, CVSS 7.0. Microsoft reports it has been exploited in real attacks. CISA lists it as a Known Exploited Vulnerability, meaning attacks have been seen (added 2026-08-11; federal agencies must fix it by 2026-08-25). Fixed in the August 2026 Windows security update (KB5120228, KB5120229, KB5120233) for 30 supported Windows versions; a restart is required.

  Microsoft advisory NVD record

• Patch nowMacAugust 6, 2026

  CVE-2026-65400Screen Sharing

  EPSS 0.02

  In Screen Sharing: An attacker on the network may be able to authenticate to Screen Sharing without valid credentials. Apple's fix: An authentication issue was addressed with improved state management. CISA lists it as a Known Exploited Vulnerability, meaning attacks have been seen (added 2026-08-18; federal agencies must fix it by 2026-08-21). EPSS score 0.02, the modelled probability of exploitation activity in the next 30 days. Fixed in macOS Tahoe 26.6.1, macOS Sequoia 15.7.9, macOS Sonoma 14.8.9, macOS Golden Gate 27 and macOS Tahoe 26.7.

  Apple release notes NVD record

Every release, rated

Releases in the last 90 days

How we rate risk

Four tiers, from the vendors' own data

We don't rescore anything. Each tier follows from fields Microsoft, Apple, CISA and FIRST publish: severity, CVSS vector, Microsoft's exploitability assessment, Apple's impact statement, the Known Exploited Vulnerabilities list and EPSS. Collected every two hours from MSRC, Apple, CISA and FIRST.

• Patch now

  Confirmed exploited in real attacks, by Microsoft, by Apple's own release notes, or by CISA's Known Exploited Vulnerabilities list.

• This week

  Windows: rated Critical, publicly disclosed before the fix, or rated "exploitation more likely" by Microsoft. Mac: Apple describes running code, kernel or root privileges, a sandbox escape or a remote attacker. Either platform: an EPSS score of 0.10 or higher.

• Normal cycle

  Everything else that the regular monthly rollout handles: install it on schedule, with testing, without emergency changes.

• Low

  Windows: denial-of-service or information-disclosure flaws scored below 6.0 that Microsoft rates "exploitation unlikely". Mac: issues Apple describes as an app or process crashing.