Updated one or more CVSS scores for the affected products. This is an informational change only.
Read the full article at Microsoft Security Response Center →
CVE-2026-70125 Microsoft Office Outlook Remote Code Execution Vulnerability
About this summary. This is a short excerpt from the description that Microsoft Security Response Center published with its article. Cyber Security News did not report or verify the underlying story. Read the original: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70125
Source attribution: headline and facts are from Microsoft Security Response Center (msrc.microsoft.com). Summary method: excerpt of the source description. See our source attribution policy.
Related coverage
What exploited vulnerabilities have in common: A data-driven analysis of real-world attacks
Classifying the vulnerability landscape Vulnerabilities exploited in the wild Where defenders should focusPatching is slow, while exploitation is fast Impact, exposure…
ZDI-26-850: Microsoft Qlib MLflowRecorder Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this…
ZDI-26-849: Microsoft Qlib RestrictedUnpickler Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this…
ZDI-26-848: Microsoft Qlib StaticDataLoader Deserialization of Untrusted Data Remote Code Execution Vulnerability
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Qlib. User interaction is required to exploit this…
CVE-2026-70007 .NET Framework Remote Code Execution Vulnerability
Updated an acknowledgement. This is an informational change only.
CVE-2026-62765 Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.