Improper certificate validation in Windows Active Directory allows an authorized attacker to elevate privileges locally.

The remote Windows host is missing security update 5099538. It is, therefore, affected by multiple vulnerabilities

  - Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a     network. (CVE-2026-58594)

  - Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a     network. (CVE-2026-49172)

  - Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized     attacker to elevate privileges locally. (CVE-2026-42982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5099540. It is, therefore, affected by multiple vulnerabilities

  - Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a     network. (CVE-2026-58594)

  - Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a     network. (CVE-2026-49172)

  - Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized     attacker to elevate privileges locally. (CVE-2026-42982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5099535. It is, therefore, affected by multiple vulnerabilities

  - Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a     network. (CVE-2026-58594)

  - Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a     network. (CVE-2026-49172)

  - Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized     attacker to elevate privileges locally. (CVE-2026-42982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5099536. It is, therefore, affected by multiple vulnerabilities

  - Integer overflow or wraparound in Windows RDP allows an unauthorized attacker to execute code over a     network. (CVE-2026-58594)

  - Heap-based buffer overflow in Windows FTP Service allows an unauthorized attacker to execute code over a     network. (CVE-2026-49172)

  - Improper validation of consistency within input in Windows Secure Kernel Mode allows an authorized     attacker to elevate privileges locally. (CVE-2026-42982)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

ID	Name	Product	Family	Type	Severity
326875	KB5099538: Windows 10 version 1809 / Windows Server 2019 Security Update (July 2026)	Nessus	Windows : Microsoft Bulletins	Local	critical
326866	KB5099540: Windows Server 2022 / Azure Stack HCI 22H2 Security Update (July 2026)	Nessus	Windows : Microsoft Bulletins	Local	critical
326857	KB5099535: Windows 10 Version 1607 / Windows Server 2016 Security Update (July 2026)	Nessus	Windows : Microsoft Bulletins	Local	critical
326849	KB5099536: Windows Server 2025 Security Update (July 2026)	Nessus	Windows : Microsoft Bulletins	Local	critical

Detections

Analytics

CVE-2026-55001

high

Tenable Plugins

critical

critical

critical

critical