CVE-2026-65668
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
CVSS
8.8
High
EPSS
—
KEV
—
Exploit Today
—
0-100
Published: Aug 7, 2026 · Last modified: Aug 7, 2026 · CWE-284
Not enough EPSS history yet.
Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges over a network.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-191957.8 HIG—
———A vulnerability has been found in V-Secure Jingyun Antivirus 2.4.2.39. The affected element is an unknown function in the library ZyArk.sys of the component Kernel Driver. The manipulation leads to improper access controls. The attack needs to be performed locally. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.4hCVE-2026-191937.8 HIG—
———A flaw has been found in Jiangmin Antivirus 21. Impacted is the function MessageNotifyCallback in the library kvcore.sys of the component Minifilter Port. Executing a manipulation can lead to improper access controls. The attack needs to be launched locally. The exploit has been published and may be used. The vendor was contacted early about this disclosure but did not respond in any way.4hCVE-2026-191927.8 HIG—
———A vulnerability was detected in DeepCool DisplayService 1.2.12. This issue affects some unknown processing of the file C:\DeepCool\resources\service\x64\DeepCoolDisplayService.exe. Performing a manipulation results in improper access controls. The attack must be initiated from a local position. The exploit is now public and may be used.4hCVE-2026-561619.6 CRI—
———Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a network.7hCVE-2026-190656.3 MED—
———A vulnerability was determined in SourceCodester Online Examination & Learning Management System 1.0. This issue affects some unknown processing of the file upload_files.php. This manipulation causes unrestricted upload. The attack may be initiated remotely.11hCVE-2025-145619.0 CRI—
———In multi-tenant deployments, the Publisher REST APIs fail to enforce tenant isolation correctly. This allows a user in one tenant, possessing sufficient privileges to invoke these APIs, to perform operations that impact other tenants.
The vulnerability allows a privileged user to perform publisher operations such as exposing or modifying API Metadata in another tenant environment. This impact is only realized in multi-tenant deployments.11h