Microsoft has published details on four critical vulnerabilities affecting Microsoft 365 Apps For Enterprise and related Office products. All four flaws carry CVSS scores of 9.8 and allow remote code execution over a network.
Correction (Oct 13): An earlier version said the four Microsoft 365 Apps CVEs carry maximum severity scores. They are rated 9.8 (critical) under CVSS 3.1 by Microsoft; the maximum is 10. The story also now lists affected products, including Windows versions for CVE-2026-70096.
CVE-2026-70096 stems from a heap-based buffer overflow in the Windows Rich Text Edit Control.
CVE-2026-70300 results from an untrusted pointer dereference in Microsoft Office Word.
Enterprises should prioritize these updates across all Office deployments given the network-based attack vector and critical severity.
Tap a lens to see what this story means for you.
Liked this? The Brief brings you the whole day in tech, verified, every morning.
Two minutes, free forever. What's in The Brief →
See what’s happening right now
The Feed runs all day — short, verified briefs the moment they break.
Open the FeedFollow @thecircuitry_
Every story we publish, as it happens. No noise between.
Reader-supported
The Circuitry is a passion project I've always wanted to build, and I love the work behind it.
Running it costs real money. APIs, hosting, time. To keep improving the site and growing this into something useful for everyone, those costs have to be covered.
Any contribution is appreciated. If not, no pressure. Thanks for reading.
Two critical issues strike Adobe Commerce and related products, including one with a top CVSS rating of 10 that permits code execution without user action.
Xbox has created a new division called Xbox Labs headed by CTO Scott Van Vliet to explore emerging technology. The move lets the company test new tools while keeping its existing game, hardware, and community priorities unchanged.
NetEase Cloud Music for Windows versions 3.1.38 and 3.1.39.205426 contain two high-severity vulnerabilities, CVE-2026-109422 and CVE-2026-109423. The flaws allow remote code execution and TLS certificate validation bypass that can lead to account takeover.
CISA added CVE-2026-104935 affecting Ivanti Connect Secure to its Known Exploited Vulnerabilities catalog on October 13 per the primary entry (independent coverage may still be catching up). The flaw allows remote unauthenticated attackers to execute arbitrary commands and carries a patching deadline of October 16.
Siemens has disclosed three critical flaws, CVE-2026-63350, CVE-2026-63353 and CVE-2026-63354, in how dozens of SIMATIC controllers, including the S7-1500 family, handle imported trace files. Siemens rates each 9.6 (CVSS 3.1). An attacker must trick a user into importing a malicious trace file.
