Microsoft known exploited vulnerabilities
Every Microsoft CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 390 in all, 42 added in the last 12 months.
- CVE-2020-0683An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer EleMicrosoft Windows
- CVE-2020-0674A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2020-0646A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2… +4
- CVE-2020-0601A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacMicrosoft Windows · stdlib
- CVE-2019-1429A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-1367A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-1215An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of PrMicrosoft Windows
- CVE-2019-1214An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aMicrosoft Windows
- CVE-2019-0863An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting ElevatioMicrosoft Windows
- CVE-2019-0859An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-0808An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-0803An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-0797An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows Server · Microsoft Windows
- CVE-2019-0708A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attackerMicrosoft Windows
- CVE-2019-0604A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application paMicrosoft SharePoint Server · Microsoft SharePoint Found… +1
- CVE-2019-0541A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code ExMicrosoft Office · Microsoft Internet Explorer +1
- CVE-2018-8653A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-0802Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code executMicrosoft Equation Editor
- CVE-2018-0798Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execuMicrosoft Equation Editor
- CVE-2017-8759Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious documeMicrosoft .NET Framework
- CVE-2017-7269Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows S
- CVE-2017-11882Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 Microsoft Office
- CVE-2017-11774Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how MicrosMicrosoft Outlook
- CVE-2017-0199Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, WindowsMicrosoft Office/WordPad
- CVE-2017-0143The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2016-7255The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012
- CVE-2016-3235Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading
- CVE-2016-0185Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted
- CVE-2016-0167The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 G
- CVE-2015-1641Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3,
- CVE-2014-1812The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, a
- CVE-2012-0158The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office
- CVE-2021-42287Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2021-42278Active Directory Domain Services Elevation of Privilege VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2021-31166HTTP Protocol Stack Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2017-0148The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2021-34484Windows User Profile Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2010-4398Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP
- CVE-2021-38646Microsoft Office Access Connectivity Engine Remote Code Execution VulnerabilityMicrosoft 365 Apps for Enterprise · Microsoft Office 201… +1
- CVE-2021-34486Windows Event Tracing Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2018-8440An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows AMicrosoft Windows
- CVE-2018-8406An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "Microsoft Windows Server · Microsoft Windows
- CVE-2018-8405An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "Microsoft Windows Server 2012 R2 · Microsoft Windows RT +2
- CVE-2017-0213Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2Microsoft Windows COM
- CVE-2017-0059Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, Microsoft Internet Explorer
- CVE-2017-0037Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the Layout::MultiColumnBoxBuilder::HandleColumnBreakMicrosoft Internet Browser
- CVE-2016-7201The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memMicrosoft.ChakraCore
- CVE-2016-7200The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memMicrosoft.ChakraCore
- CVE-2016-0189The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo
- CVE-2016-0151The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold
FAQ
Microsoft KEV questions.
How many Microsoft vulnerabilities are in CISA KEV?
390 Microsoft vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 42 of them added in the last 12 months. The newest is CVE-2026-96951 (Microsoft Windows Command Injection Vulnerability), added 2026-10-13.
Which Microsoft products are in CISA KEV?
71 products, including Windows, SharePoint, SQL Server. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Microsoft KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 117 of the 390 Microsoft entries.