Microsoft Addresses Critical Vulnerability CVE-2026-3926 in Multiple Products

Microsoft has released security updates to address a critical vulnerability affecting multiple products. The vulnerability, tracked as CVE-2026-3926, could allow an attacker to execute arbitrary code on affected systems.

Affected Products

The following Microsoft products are affected by CVE-2026-3926:

• Windows 10 (versions 1909, 2004, 20H2, 21H1, 21H2)
• Windows 11 (versions 21H2, 22H2)
• Windows Server 2022
• Microsoft Office 2019
• Microsoft Office 2021
• Microsoft 365 Apps

Severity and Impact

CVE-2026-3926 has been assigned a CVSS score of 8.8, indicating a high severity vulnerability. Exploitation of this vulnerability could allow an attacker to:

• Execute arbitrary code with elevated privileges
• Install programs
• View, change, or delete data
• Create new accounts with full user rights

The vulnerability exists in the way Microsoft Windows handles objects in memory. An attacker who successfully exploited the vulnerability could gain the same user rights as the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system.

Mitigation

Microsoft has addressed this vulnerability in the following security updates:

• Security Update for Windows 10 (KB5044391)
• Security Update for Windows 11 (KB5044392)
• Security Update for Microsoft Office (KB5044393)

Organizations should apply these updates as soon as possible. For systems that cannot be immediately updated, Microsoft recommends implementing the following workarounds:

1. Enable Windows Defender Exploit Guard
2. Configure Microsoft Office to run in protected mode
3. Restrict access to affected components through network firewalls

Timeline

• Discovery: January 2024
• Patch Release: May 2024
• Public Disclosure: May 2024

Additional Resources

For more information about this vulnerability, refer to the following resources:

• Microsoft Security Advisory CVE-2026-3926
• CISA Alert AA24-123A
• MSRC Blog Post

Organizations experiencing issues with the updates should contact Microsoft Support through the Microsoft Security Response Center.