Microsoft
Vulnerability activity for Microsoft: what is being exploited, what was published lately, and when the next patch release is due.
Last 30 days
- CVEs
- 436
- Critical (CVSS 9+)
- 15
- Exploited (CISA KEV)
- 1
- With exploit code
- 0
Last 90 days
- CVEs
- 476
- Critical (CVSS 9+)
- 17
- Exploited (CISA KEV)
- 8
- With exploit code
- 2
Last 365 days
- CVEs
- 566
- Critical (CVSS 9+)
- 26
- Exploited (CISA KEV)
- 42
- With exploit code
- 14
Next expected patch release
Microsoft Patch Tuesday
Nov 10, 2026, in 12 days
Expected from the vendor's usual schedule; vendors can shift dates. Patch Tuesday page
Exploited now
CVEs on CISA's known-exploited list, newest first. "Days to KEV" counts from the CVE's publication.
- 8.8HighOct 13, 2026Microsoft Windows Code / command injectionCVE-2026-96951Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.Added to KEV Oct 13, 2026 · same day as publicationExploited1.5% likely
- 8.8HighSep 25, 2026Microsoft SharePoint Code / command injectionCVE-2026-65660Microsoft SharePoint server with affected versions is vulnerable. An attacker gains arbitrary code execution and remote code execution. Update to the latest patched version of Microsoft SharePoint server.Added to KEV Sep 25, 2026Exploited2.1% likely
- 7.8HighSep 8, 2026Microsoft Windows Memory corruptionCVE-2026-85880Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.Added to KEV Sep 8, 2026Exploited3.6% likely
- 7.8HighSep 8, 2026Microsoft Windows Path traversal / file handlingCVE-2026-81963Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.Added to KEV Sep 8, 2026Exploited
- 8.8HighAug 26, 2026Microsoft SQL Server Code / command injectionCVE-2019-1068Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.Added to KEV Aug 26, 2026Exploited57% likelyExploit code
- 9.1CriticalAug 18, 2026Microsoft SharePoint Auth bypass / access controlCVE-2026-55040Microsoft SharePoint Server is affected. An attacker gains unauthorized access to sensitive information and potentially executes arbitrary code. Patch SharePoint Server with the latest security updates and enforce strong authentication mechanisms.Added to KEV Aug 18, 2026Exploited70% likelyExploit codeNucleiDetection
- 9.8CriticalAug 18, 2026Microsoft Internet Key Exchange (IKE) Service Extensions Memory corruptionCVE-2026-33824Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.Added to KEV Aug 18, 2026Exploited1.6% likelyDetection
- 7.0HighAug 11, 2026Microsoft Windows Ancillary Function Driver for WinSock Memory corruptionCVE-2026-68820Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.Added to KEV Aug 11, 2026Exploited
- 9.8CriticalJul 22, 2026Microsoft SharePoint DeserializationCVE-2026-50522Microsoft SharePoint Server and SharePoint Foundation. An attacker gains remote code execution. Patch SharePoint Server and SharePoint Foundation to the latest version and ensure that all dependencies are up-to-date.Added to KEV Jul 22, 2026Exploited3% likely
- 9.8CriticalJul 16, 2026Microsoft SharePoint DeserializationCVE-2026-58644Microsoft SharePoint is affected. An attacker gains remote code execution. Update to SharePoint 2022 CU December 2022 or later and ensure deserialization protections are enabled.Added to KEV Jul 16, 2026Exploited16% likelyExploit codeNucleiDetection
- 5.3MediumJul 14, 2026Microsoft SharePoint Server Auth bypass / access controlCVE-2026-56164Microsoft SharePoint Server is affected. An attacker gains ability to perform arbitrary file operations on the server. Patch SharePoint Server with the latest security updates and restrict access to sensitive areas.Added to KEV Jul 14, 2026Exploited1% likelyExploit code
- 7.8HighJul 14, 2026Microsoft Active Directory Federation Services Auth bypass / access controlCVE-2026-56155Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.Added to KEV Jul 14, 2026Exploited
- 8.8HighJul 1, 2026Microsoft SharePoint Server DeserializationCVE-2026-45659Microsoft SharePoint Server is affected. An attacker gains arbitrary code execution. Patch SharePoint Server to the latest version available.Added to KEV Jul 1, 2026Exploited80% likelyExploit codeDetection
- 4.0MediumMay 20, 2026Microsoft Defender Denial of serviceCVE-2026-45498Microsoft Defender contains an unspecified vulnerability that allows for denial of service.Added to KEV May 20, 2026Exploited63% likely
- 7.8HighMay 20, 2026Microsoft Defender Path traversal / file handlingCVE-2026-41091Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.Added to KEV May 20, 2026Exploited8.2% likely
- 8.8HighMay 20, 2026Microsoft Internet Explorer Memory corruptionCVE-2010-0806Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Added to KEV May 20, 2026Exploited82% likelyExploit codeExploit-DB · Metasploit
- 8.8HighMay 20, 2026Microsoft Internet Explorer Memory corruptionCVE-2010-0249Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.Added to KEV May 20, 2026Exploited92% likelyExploit codeExploit-DB · Metasploit
- 8.8HighMay 20, 2026Microsoft DirectXCVE-2009-1537Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.Added to KEV May 20, 2026Exploited51% likely
- 9.8CriticalMay 20, 2026Microsoft Windows Code / command injectionCVE-2008-4250Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.Added to KEV May 20, 2026Exploited99% likelyExploit codeExploit-DB · Metasploit
- 8.1HighMay 15, 2026Microsoft XSSCVE-2026-42897Microsoft Exchange Server web interface. An attacker gains access to sensitive information and potentially executes arbitrary code. Update Microsoft Exchange Server to the latest version and apply all available security patches.Added to KEV May 15, 2026Exploited71% likelyDetection
- 4.3MediumApr 28, 2026Microsoft WindowsCVE-2026-32202Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.Added to KEV Apr 28, 2026Exploited71% likelyExploit codeExploit-DB
- 7.8HighApr 22, 2026Microsoft Defender Auth bypass / access controlCVE-2026-33825Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.Added to KEV Apr 22, 2026Exploited6.7% likely
- 6.5MediumApr 14, 2026Microsoft SharePoint ServerCVE-2026-32201Microsoft SharePoint Server An attacker gains unauthorized access to sensitive information Patch SharePoint Server with the latest security updates and restrict access to the vulnerable feature.Added to KEV Apr 14, 2026Exploited43% likely
- 8.8HighApr 14, 2026Microsoft Office Code / command injectionCVE-2009-0238Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.Added to KEV Apr 14, 2026Exploited43% likely
- 7.8HighApr 13, 2026Microsoft Windows Memory corruptionCVE-2023-36424Microsoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalationAdded to KEV Apr 13, 2026Exploited12% likely
Recent
- 8.8HighOct 29, 2026Microsoft Edge (Chromium-based) Memory corruptionCVE-2026-88077Integer overflow or wraparound in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
- 5.4MediumOct 29, 2026Microsoft Edge (Chromium-based) Memory corruptionCVE-2026-88090Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to elevate privileges over a network.
- 7.8HighOct 29, 2026Microsoft .NET 10.0 installed on Linux Privilege escalationCVE-2026-114148Incorrect default permissions in ASP.NET Core allows an authorized attacker to elevate privileges locally.
- 7.5HighOct 27, 2026Microsoft Edge (Chromium-based) Memory corruptionCVE-2026-62765Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- 8.8HighOct 27, 2026Microsoft Memory corruptionCVE-2026-85898Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- 8.8HighOct 27, 2026Microsoft Memory corruptionCVE-2026-83831Double free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a network.
- 6.9MediumOct 27, 2026Backup for Microsoft 365 Crypto / certificateCVE-2026-106078A vulnerability allowing an unauthenticated attacker to bypass REST API authentication with a forged federation token and receive responses from REST API endpoints that do not call the Veeam Backup for Microsoft 365 backup service.
- 8.3HighOct 27, 2026Backup for Microsoft 365 Auth bypass / access controlCVE-2026-106077A vulnerability allowing a user with the Veeam Backup for Microsoft 365 Administrator role to read arbitrary files on the backup server with LocalSystem privileges.
- 9.0CriticalOct 27, 2026Backup for Microsoft 365 SQL injectionCVE-2026-106076A vulnerability allowing an authenticated organization-transfer peer to inject SQL into the configuration database of the source Veeam Backup for Microsoft 365 server, leading to cross-tenant read and write of configuration data and remote code execution as the PostgreSQL service account.
- 4.3MediumOct 27, 2026Backup for Microsoft 365 Path traversal / file handlingCVE-2025-64394A vulnerability allowing a low-privileged local user to write arbitrary files with SYSTEM privileges during the installation of Veeam Backup for Microsoft 365, which can lead to privilege escalation or denial of service.
- –UnscoredOct 27, 2026MicrosoftCVE-2026-20942
- –UnscoredOct 27, 2026MicrosoftCVE-2026-88078
- –UnscoredOct 27, 2026MicrosoftCVE-2026-96196
- –UnscoredOct 26, 2026Microsoft WindowsCVE-2026-116638The Windows Recovery Environment (WinRE) in Windows 10 and 11 may allow an attacker to bypass firmware security controls, including administrator-configured UEFI/BIOS passwords. An attacker with physical or administrative access to a device may be able to leverage WinRE-related boot mechanisms to circumvent firmware protections and gain unauthorized access to system resources.
- 10.0CriticalOct 22, 2026Microsoft VM Inspector for Azure Virtual Machines Path traversal / file handlingCVE-2026-110063Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
- 10.0CriticalOct 22, 2026Microsoft Azure Kubernetes Configuration Service Auth bypass / access controlCVE-2026-83938Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
- 7.5HighOct 22, 2026Microsoft Exchange Online Memory corruptionCVE-2026-96185Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
- 10.0CriticalOct 22, 2026Microsoft Entra application proxy Auth bypass / access controlCVE-2026-97785Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
- 7.7HighOct 22, 2026Microsoft Azure AI Foundry SSRFCVE-2026-108456Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
- 9.1CriticalOct 22, 2026Microsoft Azure Pipelines Code / command injectionCVE-2026-105014Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
- 5.3MediumOct 16, 2026microsoft-identity-web Auth bypass / access controlCVE-2026-80092Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
- –UnscoredOct 16, 2026MicrosoftCVE-2026-85890
- –UnscoredOct 16, 2026MicrosoftCVE-2026-85897
- –UnscoredOct 16, 2026MicrosoftCVE-2026-96198
- –UnscoredOct 16, 2026MicrosoftCVE-2026-96199
- 8.8HighOct 13, 2026Microsoft Windows Code / command injectionCVE-2026-96951Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.Exploited1.5% likely
- 5.5MediumOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-96910Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
- 7.0HighOct 13, 2026Microsoft windows 11 24h2 Memory corruptionCVE-2026-96868Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
- 7.8HighOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-96867Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.
- 5.5MediumOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-96860Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.
- 5.5MediumOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-96859Out-of-bounds read in Windows Imaging Component allows an authorized attacker to disclose information locally.
- 5.5MediumOct 13, 2026Microsoft windows 10 21h2 Auth bypass / access controlCVE-2026-96858Missing authentication for critical function in Windows Security Account Manager allows an authorized attacker to perform tampering locally.
- 8.8HighOct 13, 2026Microsoft Edge (Chromium-based) Memory corruptionCVE-2026-96202Heap-based buffer overflow in Windows Raw Image Extension allows an unauthorized attacker to execute code over a network.
- 8.8HighOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88159Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.1.4% likely
- 8.8HighOct 13, 2026Microsoft windows 10 1809 Memory corruptionCVE-2026-88157Heap-based buffer overflow in OpenSSH for Windows allows an unauthorized attacker to execute code over a network.
- 7.0HighOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88149Double free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- 7.8HighOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88147Heap-based buffer overflow in Windows Secure Socket Tunneling Protocol (SSTP) allows an authorized attacker to elevate privileges locally.
- 7.0HighOct 13, 2026Microsoft windows 10 1809CVE-2026-88146Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
- 6.7MediumOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88143Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
- 8.8HighOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88142Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
- 5.5MediumOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88140Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.
- 7.8HighOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88134Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
- 7.8HighOct 13, 2026Microsoft windows 10 1607 Path traversal / file handlingCVE-2026-88133Improper authorization in Windows Portable Device Enumerator Service allows an authorized attacker to elevate privileges locally.
- 7.8HighOct 13, 2026Microsoft windows 10 1809 Memory corruptionCVE-2026-88128Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
- 7.0HighOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88124Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.
- 8.0HighOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88121Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
- 8.1HighOct 13, 2026Microsoft windows server 2012 Memory corruptionCVE-2026-88119Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
- 7.8HighOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88118Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.
- 8.1HighOct 13, 2026Microsoft windows server 2012 Memory corruptionCVE-2026-88117Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
- 8.8HighOct 13, 2026Microsoft windows 10 1607 Memory corruptionCVE-2026-88115Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network.
Top products
- windows 10 1607257 CVEs in the last year, 7 critical
- windows 10 180951 CVEs in the last year, 1 critical
- windows 10 21h223 CVEs in the last year
- windows 11 23h221 CVEs in the last year
- Windows17 CVEs in the last year, 1 critical, 16 exploited
- windows 11 24h216 CVEs in the last year
- Windows 10 Version 160714 CVEs in the last year, 2 critical
- edge chromium14 CVEs in the last year
- .net framework10 CVEs in the last year
- .net9 CVEs in the last year
Advisories
Official advisories from the last 90 days that name this vendor's CVEs.
- Veeam · Oct 29, 2026Vulnerabilities Resolved in Veeam Management Pack for Microsoft System Center 13.1CVE-2023-22793CVE-2026-107238CVE-2026-107239
- Microsoft MSRC · Oct 28, 2026CVE-2026-62877 Windows Win32k Elevation of Privilege VulnerabilityCVE-2026-62877
- Microsoft MSRC · Oct 28, 2026CVE-2026-62740 Windows Imaging Component Information Disclosure VulnerabilityCVE-2026-62740
- Microsoft MSRC · Oct 27, 2026CVE-2026-70007 .NET Framework Remote Code Execution VulnerabilityCVE-2026-70007
- Microsoft MSRC · Oct 27, 2026CVE-2026-88078 Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2026-88078
- Microsoft MSRC · Oct 27, 2026CVE-2026-96196 Microsoft Edge (Chromium-based) Security Feature Bypass VulnerabilityCVE-2026-96196
- Microsoft MSRC · Oct 27, 2026CVE-2026-69284 Windows DCOM Server Elevation of Privilege VulnerabilityCVE-2026-69284
- Microsoft MSRC · Oct 27, 2026CVE-2026-70161 .NET Elevation of Privilege VulnerabilityCVE-2026-70161
- Microsoft MSRC · Oct 27, 2026CVE-2026-62765 Microsoft Edge (Chromium-based) Remote Code Execution VulnerabilityCVE-2026-62765
- Microsoft MSRC · Oct 27, 2026CVE-2026-96225 .NET Elevation of Privilege VulnerabilityCVE-2026-96225
- Microsoft MSRC · Oct 27, 2026CVE-2026-20942 Microsoft Edge (Chromium-based) Spoofing VulnerabilityCVE-2026-20942
- Microsoft MSRC · Oct 27, 2026CVE-2026-70277 Windows Fast FAT File System Driver Information Disclosure VulnerabilityCVE-2026-70277
- Microsoft MSRC · Oct 27, 2026CVE-2026-69473 Windows Kernel Elevation of Privilege VulnerabilityCVE-2026-69473
- Veeam · Oct 27, 2026Vulnerabilities Resolved in Veeam Backup for Microsoft 365 8.6CVE-2025-64394CVE-2026-106076CVE-2026-106077CVE-2026-106078
- Microsoft MSRC · Oct 26, 2026CVE-2026-69926 Desktop Window Manager Elevation of Privilege VulnerabilityCVE-2026-69926
Counts cover CVEs and advisories Watch Floor tracks, by the date they became news. Updated every 10 minutes.