Microsoft Addresses Critical Vulnerability in Latest Security Update

Microsoft has released security updates to address CVE-2026-39825, a critical vulnerability affecting multiple Microsoft products. The vulnerability, which carries a CVSS score of 9.8, could allow attackers to execute arbitrary code with system privileges without authentication.

Affected products include:

• Windows 10 (21H2 and later)
• Windows 11 (all versions)
• Microsoft Office 2019 and 365
• Azure Active Directory
• Microsoft Exchange Server 2019 and 2022

The vulnerability exists in the way Microsoft Windows handles objects in memory. An attacker who successfully exploited this vulnerability could gain complete control over an affected system.

Microsoft has released security updates through the Microsoft Update Catalog, Windows Update, and Microsoft Update. Enterprise customers can deploy updates through WSUS, Microsoft Endpoint Configuration Manager, or other management tools.

For systems that cannot be patched immediately, Microsoft recommends:

• Disabling the affected protocols
• Implementing network segmentation
• Restricting access to affected systems
• Enabling enhanced logging for suspicious activity

Microsoft has not detected any active exploitation of this vulnerability in the wild. However, given the severity and potential impact, organizations should treat this as a high-priority security issue.

The security updates are available now. Organizations should prioritize patching systems that are directly accessible from the internet first.

For more information about CVE-2026-39825 and related vulnerabilities, visit the Microsoft Security Response Center website or the official security advisory.