Microsoft known exploited vulnerabilities
Every Microsoft CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 390 in all, 42 added in the last 12 months.
- CVE-2022-41040Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2010-2568Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or r
- CVE-2022-37969Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-26923Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21971Windows Runtime Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2022-34713Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2017-8570Microsoft Office allows a remote code execution vulnerability due to the way that it handles objects in memory, aka "Microsoft Office RemoteMicrosoft Office 2007 SP3, Microsoft Office 2010 SP2, Micro…
- CVE-2017-0222A remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory, aka "Internet Explorer Memory CorMicrosoft Internet Explorer
- CVE-2014-6352Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and
- CVE-2019-0752A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2018-8174A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemMicrosoft Windows
- CVE-2014-1761Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Wor
- CVE-2013-3906GDI+ in Microsoft Windows Vista SP2 and Server 2008 SP2; Office 2003 SP3, 2007 SP3, and 2010 SP1 and SP2; Office Compatibility Pack SP3; and
- CVE-2020-0796A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requeMicrosoft Windows
- CVE-2017-8464Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, WindoMicrosoft Windows Shell
- CVE-2017-0263The kernel-mode drivers in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, WindowMicrosoft Windows
- CVE-2017-0262Microsoft Office 2010 SP2, Office 2013 SP1, and Office 2016 allow a remote code execution vulnerability when the software fails to properly Microsoft Office
- CVE-2017-0145The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2017-0144The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2015-1635HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote a
- CVE-2022-22047Windows Client Server Run-time Subsystem (CSRSS) Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-0787An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic lMicrosoft Windows
- CVE-2014-1776Use-after-free vulnerability in Microsoft Internet Explorer 6 through 11 allows remote attackers to execute arbitrary code or cause a denial
- CVE-2022-26925Windows LSA Spoofing VulnerabilityMicrosoft Windows
- CVE-2018-8453An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2019-1458An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2013-3900WinVerifyTrust Signature Validation VulnerabilityMicrosoft Windows
- CVE-2022-30190Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2013-1331Buffer overflow in Microsoft Office 2003 SP3 and Office 2011 for Mac allows remote attackers to execute arbitrary code via crafted PNG data
- CVE-2012-4969Use-after-free vulnerability in the CMshtmlEd::Exec function in mshtml.dll in Microsoft Internet Explorer 6 through 9 allows remote attacker
- CVE-2012-1889Microsoft XML Core Services 3.0, 4.0, 5.0, and 6.0 accesses uninitialized memory locations, which allows remote attackers to execute arbitra
- CVE-2012-0151The Authenticode Signature Verification function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Se
- CVE-2010-2572Buffer overflow in Microsoft PowerPoint 2002 SP3 and 2003 SP3 allows remote attackers to execute arbitrary code via a crafted PowerPoint 95
- CVE-2009-0563Stack-based buffer overflow in Microsoft Office Word 2002 SP3, 2003 SP3, and 2007 SP1 and SP2; Microsoft Office for Mac 2004 and 2008; Open
- CVE-2009-0557Excel in Microsoft Office 2000 SP3, Office XP SP3, Office 2003 SP3, and Office 2004 and 2008 for Mac; Excel in 2007 Microsoft Office System
- CVE-2006-2492Buffer overflow in Microsoft Word in Office 2000 SP3, Office XP SP3, Office 2003 Sp1 and SP2, and Microsoft Works Suites through 2006, allow
- CVE-2016-7256atmfd.dll in the Windows font library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Window
- CVE-2016-3393Graphics Device Interface (aka GDI or GDI+) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1;
- CVE-2016-0034Microsoft Silverlight 5 before 5.1.41212.0 mishandles negative offsets during decoding, which allows remote attackers to execute arbitrary c
- CVE-2015-6175The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevatio
- CVE-2015-2425Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a craf
- CVE-2015-2360win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1
- CVE-2015-1769Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012
- CVE-2015-1671The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010
- CVE-2015-0071Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Intern
- CVE-2015-0016Directory traversal vulnerability in the TS WebProxy (aka TSWbPrxy) component in Microsoft Windows Vista SP2, Windows 7 SP1, Windows Server
- CVE-2014-4148win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7
- CVE-2014-4123Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation
- CVE-2014-4077Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.E
- CVE-2014-2817Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation
FAQ
Microsoft KEV questions.
How many Microsoft vulnerabilities are in CISA KEV?
390 Microsoft vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 42 of them added in the last 12 months. The newest is CVE-2026-96951 (Microsoft Windows Command Injection Vulnerability), added 2026-10-13.
Which Microsoft products are in CISA KEV?
71 products, including Windows, SharePoint, SQL Server. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Microsoft KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 117 of the 390 Microsoft entries.