Microsoft known exploited vulnerabilities
Every Microsoft CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 390 in all, 42 added in the last 12 months.
- CVE-2026-96951Windows Shell Security Feature Bypass VulnerabilityMicrosoft Edge · Microsoft Outlook.com +1
- CVE-2026-65660Microsoft SharePoint Server Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-85880Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-81963Windows Update Stack Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1068A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'MicrMicrosoft SQL Server 2014 Service Pack 2 for 32-bit Systems…
- CVE-2026-55040Microsoft SharePoint Server Security Feature Bypass VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-33824Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2026-68820Windows Ancillary Function Driver for WinSock Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-50522Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-58644Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-56164Microsoft SharePoint Server Elevation of Privilege VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-56155Active Directory Federation Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-45659Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2026-45498Microsoft Defender Denial of Service VulnerabilityMicrosoft Defender Antimalware Platform
- CVE-2026-41091Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Malware Protection Engine
- CVE-2010-0806Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote at
- CVE-2010-0249Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2
- CVE-2009-1537Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows
- CVE-2008-4250The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta a
- CVE-2026-42897Microsoft Exchange Server Spoofing VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Micro… +1
- CVE-2026-32202Windows Shell Spoofing VulnerabilityMicrosoft Windows
- CVE-2026-33825Microsoft Defender Elevation of Privilege VulnerabilityMicrosoft Defender Antimalware Platform
- CVE-2026-32201Microsoft SharePoint Server Spoofing VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2009-0238Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word
- CVE-2025-60710Host Process for Windows Tasks Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-36424Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2023-21529Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2012-1854Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basi
- CVE-2026-20963Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint Enterprise Server · Microsoft SharePoi…
- CVE-2008-0015Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneReques
- CVE-2024-43468Microsoft Configuration Manager Remote Code Execution VulnerabilityMicrosoft Configuration Manager
- CVE-2026-21533Windows Remote Desktop Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21525Windows Remote Access Connection Manager Denial of Service VulnerabilityMicrosoft Windows
- CVE-2026-21519Desktop Window Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2026-21514Microsoft Word Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office LTSC
- CVE-2026-21513MSHTML Framework Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-21510Windows Shell Security Feature Bypass VulnerabilityMicrosoft Windows
- CVE-2026-21509Microsoft Office Security Feature Bypass VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office
- CVE-2026-20805Desktop Window Manager Information Disclosure VulnerabilityMicrosoft Windows
- CVE-2009-0556Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to ex
- CVE-2025-62221Windows Cloud Files Mini Filter Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-62215Windows Kernel Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-59287Windows Server Update Service (WSUS) Remote Code Execution VulnerabilityMicrosoft Windows Server
- CVE-2025-33073Windows SMB Client Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-59230Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2025-24990Windows Agere Modem Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-43226Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2013-3918The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows V
- CVE-2011-3402Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3,
- CVE-2010-3962Use-after-free vulnerability in Microsoft Internet Explorer 6, 7, and 8 allows remote attackers to execute arbitrary code via vectors relate
FAQ
Microsoft KEV questions.
How many Microsoft vulnerabilities are in CISA KEV?
390 Microsoft vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 42 of them added in the last 12 months. The newest is CVE-2026-96951 (Microsoft Windows Command Injection Vulnerability), added 2026-10-13.
Which Microsoft products are in CISA KEV?
71 products, including Windows, SharePoint, SQL Server. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Microsoft KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 117 of the 390 Microsoft entries.