All updates

Critical remote-code-execution flaw patched; calendar feeds restored

The update fixes a Critical remote-code-execution vulnerability and restores published calendar feeds and Korean-language search processing affected by earlier updates.

Critical remote-code flaw patched; calendar feeds restored

Fixes a critical Exchange Server remote-code execution vulnerability and restores published calendar subscriptions that returned HTTP 500 errors.

Remote-code-execution flaw patched; published calendar errors fixed

Addresses six Exchange Server vulnerabilities, including one critical flaw, and resolves HTTP 500 errors affecting published calendar subscriptions. It is available only to organizations enrolled in the Extended Security Update program.

Critical remote-code flaw and published-calendar errors addressed

Fixes six Exchange Server vulnerabilities, including one critical remote-code-execution flaw, and resolves an issue that stopped published calendar subscriptions from refreshing. It is available only to organizations enrolled in the Extended Security Update program.

Backup and PolyBase flaws fixed; recovery queries can crash

Security fixes cover SQL Server components used for backup, PolyBase, and replication. Queries during database recovery can still trigger an access violation; a trace-flag mitigation is available.

23 SQL vulnerabilities addressed; MSDASQL linked queries still fail

Addresses 23 SQL Server vulnerabilities, including 22 rated Important. Linked server queries using MSDASQL can still fail with error 7416 in some configurations.

Recovery queries may raise access violations; security flaws fixed

Security fixes cover SQL Server components. Queries against `sys.dm_exec_requests` during database recovery might raise an access violation and create a dump file.

PolyBase security flaws addressed; linked server queries can fail

Fixes 22 Important SQL Server vulnerabilities. Linked server queries using MSDASQL and a provider string might fail with error 7416.

Database Engine vulnerabilities fixed; MSDASQL queries can fail

Fixes 21 vulnerabilities in SQL Server 2019. Linked-server queries using MSDASQL with a provider string can fail with error 7416.

21 vulnerabilities fixed; MSDASQL linked queries can fail

The update fixes 21 vulnerabilities in SQL Server 2019 GDR. A known issue can make linked server queries using MSDASQL and a provider string fail with error 7416.

Database Engine vulnerability fixes; MSDASQL queries can fail

Fixes security vulnerabilities in SQL Server 2017, but linked server queries using MSDASQL and a provider string might fail with error 7416.

SQL Satellite flaws fixed; MSDASQL linked queries can fail

The update fixes 14 vulnerabilities, including flaws in SQL Satellite and the Virtual Device Interface. Some linked-server queries that use MSDASQL can still fail with error 7416.

Critical elevation flaw closed; DCache works again

The update fixes 39 vulnerabilities, including two critical flaws, and restores Distributed Cache after a prior update broke it. It also adds the 26H2 feature update and changes ImportWeb SOAP availability.

Excel remote code execution vulnerabilities addressed before support ends

Addresses 44 vulnerabilities, including 13 critical Excel remote code execution vulnerabilities. Updates for all Office Online Server editions end December 31, 2026.

Critical AD FS spoofing flaw and .NET security bypass addressed

The update addresses 21 vulnerabilities, including a critical AD FS spoofing flaw and a publicly disclosed .NET security-feature bypass. It applies to .NET Framework 3.5 and 4.8.1 on Windows 11, version 26H2.

Critical AD FS spoofing flaw and public .NET bypass fixed

Fixes 20 security flaws, including a Critical AD FS spoofing flaw and a publicly disclosed .NET Framework flaw that bypasses a security feature. Restart if affected files are in use.

Fixes 21 vulnerabilities (1 critical)

Addresses a critical spoofing flaw and other security risks in .NET Framework. It covers 21 vulnerabilities, including one that was publicly disclosed.

Critical spoofing flaw and disclosed security bypass addressed

The update addresses 21 vulnerabilities, including one critical flaw and a publicly disclosed security bypass. It also updates .NET Framework 3.5 and 4.8.1.

AD FS spoofing flaw and disclosed security bypass addressed

Addresses 21 vulnerabilities. One is a critical AD FS spoofing flaw; another is a publicly disclosed .NET Framework security bypass.

Spoofing flaw fixed alongside a security bypass

The update fixes 21 flaws: 1 Critical, 18 Important, and 2 Unrated. They include spoofing flaw CVE-2026-96222 and publicly disclosed CVE-2026-108398, a security feature bypass.

Critical .NET spoofing flaw addressed

CVE-2026-96222 is a critical .NET Framework spoofing flaw addressed by this update. It also addresses the publicly disclosed security-feature bypass CVE-2026-108398.

Remote-code and security-bypass flaws are addressed

Addresses .NET Framework security flaws, including risks that could let attackers run code or bypass a security feature. It covers Windows Server 2022 systems with .NET Framework 3.5 or 4.8 installed.

Closes a critical spoofing flaw and a disclosed security bypass

Fixes 21 security flaws, including a critical spoofing flaw and a publicly disclosed .NET Framework security bypass. It applies to Windows 10 version 1809 and Windows Server 2019.

Critical spoofing flaw among 20 vulnerabilities fixed

Fixes 20 vulnerabilities, including one critical spoofing flaw and a publicly disclosed security-feature bypass. It applies to .NET Framework 4.8 on Windows 10, version 1607 and Windows Server 2016.