Microsoft known exploited vulnerabilities
Every Microsoft CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 390 in all, 42 added in the last 12 months.
- CVE-2020-0646A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.2… +4
- CVE-2020-0601A spoofing vulnerability exists in the way Windows CryptoAPI (Crypt32.dll) validates Elliptic Curve Cryptography (ECC) certificates.An attacMicrosoft Windows · stdlib
- CVE-2019-1429A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-1367A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2019-1215An elevation of privilege vulnerability exists in the way that ws2ifsl.sys (Winsock) handles objects in memory, aka 'Windows Elevation of PrMicrosoft Windows
- CVE-2019-1214An elevation of privilege vulnerability exists when the Windows Common Log File System (CLFS) driver improperly handles objects in memory, aMicrosoft Windows
- CVE-2019-0863An elevation of privilege vulnerability exists in the way Windows Error Reporting (WER) handles files, aka 'Windows Error Reporting ElevatioMicrosoft Windows
- CVE-2019-0859An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-0808An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-0803An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2019-0797An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows Server · Microsoft Windows
- CVE-2019-0708A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attackerMicrosoft Windows
- CVE-2019-0604A remote code execution vulnerability exists in Microsoft SharePoint when the software fails to check the source markup of an application paMicrosoft SharePoint Server · Microsoft SharePoint Found… +1
- CVE-2019-0541A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code ExMicrosoft Office · Microsoft Internet Explorer +1
- CVE-2018-8653A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "ScripMicrosoft Internet Explorer
- CVE-2018-0802Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code executMicrosoft Equation Editor
- CVE-2018-0798Equation Editor in Microsoft Office 2007, Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allows a remote code execuMicrosoft Equation Editor
- CVE-2017-8759Microsoft .NET Framework 2.0, 3.5, 3.5.1, 4.5.2, 4.6, 4.6.1, 4.6.2 and 4.7 allow an attacker to execute code remotely via a malicious documeMicrosoft .NET Framework
- CVE-2017-7269Buffer overflow in the ScStoragePathFromUrl function in the WebDAV service in Internet Information Services (IIS) 6.0 in Microsoft Windows S
- CVE-2017-11882Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 Microsoft Office
- CVE-2017-11774Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how MicrosMicrosoft Outlook
- CVE-2017-0199Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, WindowsMicrosoft Office/WordPad
- CVE-2017-0143The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2016-7255The kernel-mode drivers in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012
- CVE-2016-3235Microsoft Visio 2007 SP3, Visio 2010 SP2, Visio 2013 SP1, Visio 2016, Visio Viewer 2007 SP3, and Visio Viewer 2010 mishandle library loading
- CVE-2016-0185Media Center in Microsoft Windows Vista SP2, Windows 7 SP1, and Windows 8.1 allows remote attackers to execute arbitrary code via a crafted
- CVE-2016-0167The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 G
- CVE-2015-1641Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3,
- CVE-2014-1812The Group Policy implementation in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, a
- CVE-2012-0158The (1) ListView, (2) ListView2, (3) TreeView, and (4) TreeView2 ActiveX controls in MSCOMCTL.OCX in the Common Controls in Microsoft Office
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
How many Microsoft vulnerabilities are in CISA KEV?
390 Microsoft vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 42 of them added in the last 12 months. The newest is CVE-2026-96951 (Microsoft Windows Command Injection Vulnerability), added 2026-10-13.
Which Microsoft products are in CISA KEV?
71 products, including Windows, SharePoint, SQL Server. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Microsoft KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 117 of the 390 Microsoft entries.