Microsoft known exploited vulnerabilities
Every Microsoft CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 390 in all, 42 added in the last 12 months.
- CVE-2021-31201Microsoft Enhanced Cryptographic Provider Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-31199Microsoft Enhanced Cryptographic Provider Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-28310Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-27085Internet Explorer Remote Code Execution VulnerabilityMicrosoft Internet Explorer
- CVE-2021-27065Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +2
- CVE-2021-27059Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office 2010 Service Pack · Microsoft Office 20… +1
- CVE-2021-26858Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-26857Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2010 Service Pack · Microsoft… +3
- CVE-2021-26855Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-26411Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer · Microsoft Edge
- CVE-2021-1732Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1675Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-1647Microsoft Defender Remote Code Execution VulnerabilityMicrosoft System Center Endpoint Protection · Microsoft… +3
- CVE-2020-17144Microsoft Exchange Remote Code Execution VulnerabilityMicrosoft Exchange Server 2010 Service Pack 3 Update Rollup
- CVE-2020-17087Windows Kernel Local Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-1472Netlogon Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows Server,
- CVE-2020-1464Windows Spoofing VulnerabilityMicrosoft Windows
- CVE-2020-1380Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer
- CVE-2020-1350A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows Microsoft Windows Server · Microsoft Windows Server,
- CVE-2020-1147A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check theMicrosoft SharePoint Enterprise Server · Microsoft Shar… +21
- CVE-2020-1054Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-1040A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaMicrosoft Windows Server
- CVE-2020-1020A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a speciallyMicrosoft Windows
- CVE-2020-0986An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka 'Windows Kernel ElevaMicrosoft Windows
- CVE-2020-0968A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2020-0938A remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles a speciallyMicrosoft Windows
- CVE-2020-0878Microsoft Browser Memory Corruption VulnerabilityMicrosoft ChakraCore · Microsoft Edge +1
- CVE-2020-0688A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, akMicrosoft Exchange Server
- CVE-2020-0683An elevation of privilege vulnerability exists in the Windows Installer when MSI packages process symbolic links, aka 'Windows Installer EleMicrosoft Windows
- CVE-2020-0674A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
How many Microsoft vulnerabilities are in CISA KEV?
390 Microsoft vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 42 of them added in the last 12 months. The newest is CVE-2026-96951 (Microsoft Windows Command Injection Vulnerability), added 2026-10-13.
Which Microsoft products are in CISA KEV?
71 products, including Windows, SharePoint, SQL Server. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Microsoft KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 117 of the 390 Microsoft entries.