Microsoft known exploited vulnerabilities
Every Microsoft CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 390 in all, 42 added in the last 12 months.
- CVE-2013-7331The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathna
- CVE-2013-3896Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote at
- CVE-2013-0074Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which
- CVE-2018-8611An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel ElevaMicrosoft Windows
- CVE-2017-8543Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, WinMicrosoft Windows
- CVE-2017-0210An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an Microsoft Internet Explorer
- CVE-2017-0149Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vMicrosoft Internet Explorer
- CVE-2017-0147The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2017-0022Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 Microsoft XML Core Services
- CVE-2017-0005The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Microsoft Windows GDI
- CVE-2016-3351Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, a
- CVE-2016-3298Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Window
- CVE-2016-0162Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Inter
- CVE-2020-1027An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation oMicrosoft Windows
- CVE-2020-0638An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an atMicrosoft Windows
- CVE-2019-1385An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resultiMicrosoft Windows
- CVE-2019-1130An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0880A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of PrivilegMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0703An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB InformationMicrosoft Windows
- CVE-2019-0676An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully explMicrosoft Internet Explorer
- CVE-2018-8589An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of PrivileMicrosoft Windows Server · Microsoft Windows
- CVE-2014-4113win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7
- CVE-2014-0322Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving
- CVE-2022-26904Windows User Profile Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21919Windows User Profile Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41357Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40450Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-22718Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-24521Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2015-2502Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption)
- CVE-2021-34527Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-27065Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +2
- CVE-2021-26858Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-26857Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2010 Service Pack · Microsoft… +3
- CVE-2021-26855Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2020-17144Microsoft Exchange Remote Code Execution VulnerabilityMicrosoft Exchange Server 2010 Service Pack 3 Update Rollup
- CVE-2020-17087Windows Kernel Local Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-1472Netlogon Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows Server,
- CVE-2020-1464Windows Spoofing VulnerabilityMicrosoft Windows
- CVE-2020-1380Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer
- CVE-2020-1350A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows Microsoft Windows Server · Microsoft Windows Server,
- CVE-2020-1147A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check theMicrosoft SharePoint Enterprise Server · Microsoft Shar… +21
- CVE-2020-1054Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-1040A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaMicrosoft Windows Server
- CVE-2020-1020A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a speciallyMicrosoft Windows
- CVE-2020-0986An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaMicrosoft Windows
- CVE-2020-0968A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2020-0938A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a speciallyMicrosoft Windows
- CVE-2020-0878Microsoft Browser Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Edge +1
- CVE-2020-0688A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, akMicrosoft Exchange Server
FAQ
Microsoft KEV questions.
How many Microsoft vulnerabilities are in CISA KEV?
390 Microsoft vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 42 of them added in the last 12 months. The newest is CVE-2026-96951 (Microsoft Windows Command Injection Vulnerability), added 2026-10-13.
Which Microsoft products are in CISA KEV?
71 products, including Windows, SharePoint, SQL Server. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Microsoft KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 117 of the 390 Microsoft entries.