Microsoft known exploited vulnerabilities
Every Microsoft CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 390 in all, 42 added in the last 12 months.
- CVE-2016-0189The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remo
- CVE-2016-0151The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold
- CVE-2013-2551Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web
- CVE-2022-21999Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2017-0146The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2019-1405An elevation of privilege vulnerability exists when the Windows Universal Plug and Play (UPnP) service improperly allows COM object creationMicrosoft Windows
- CVE-2019-1322An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka 'Microsoft Windows Elevation of Microsoft Windows
- CVE-2019-1315An elevation of privilege vulnerability exists when Windows Error Reporting manager improperly handles hard links, aka 'Windows Error ReportMicrosoft Windows
- CVE-2019-1253An elevation of privilege vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.To exploit this vulnerabMicrosoft Windows
- CVE-2019-1129An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows
- CVE-2019-1069Task Scheduler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-1064Windows Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2019-0841An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows
- CVE-2019-0543An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of
- CVE-2018-8120An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows Server · Microsoft Windows
- CVE-2017-0101The kernel-mode drivers in Transaction Manager in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1, WMicrosoft Windows
- CVE-2016-3309The kernel-mode drivers in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012
- CVE-2015-2546The kernel-mode driver in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Se
- CVE-2021-41379Windows Installer Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2018-8581An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege VulnerabiMicrosoft Exchange Server
- CVE-2016-0099The Secondary Logon Service in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2
- CVE-2015-1701Win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Vista SP2, and Server 2008 SP2 allows local users to gain privil
- CVE-2019-0752A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'ScripMicrosoft Internet Explorer
- CVE-2018-8174A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine RemMicrosoft Windows
- CVE-2020-0796A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requeMicrosoft Windows
- CVE-2017-0145The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2017-0144The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2022-21882Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2020-0787An elevation of privilege vulnerability exists when the Windows Background Intelligent Transfer Service (BITS) improperly handles symbolic lMicrosoft Windows
- CVE-2018-8453An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Microsoft Windows
- CVE-2019-1458An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Microsoft Windows
- CVE-2021-43890Windows AppX Installer Spoofing VulnerabilityMicrosoft App Installer
- CVE-2021-42321Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2016 Cumulative Update · Microsof…
- CVE-2021-40449Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40444Microsoft MSHTML Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-38647Open Management Infrastructure (OMI) Remote Code Execution VulnerabilityMicrosoft Azure Automation State Configuration, DSC Exte… +8
- CVE-2021-36955Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-36942Windows LSA Spoofing VulnerabilityMicrosoft Windows Server 2008 R2 Service Pack · Microsof… +1
- CVE-2021-34527Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2021-34523Microsoft Exchange Server Elevation of Privilege VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-27065Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +2
- CVE-2021-26858Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-26857Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2010 Service Pack · Microsoft… +3
- CVE-2021-26855Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server 2013 Cumulative Update · Micro… +1
- CVE-2021-26411Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer · Microsoft Edge
- CVE-2021-1732Windows Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-1675Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows
- CVE-2020-1472Netlogon Elevation of Privilege VulnerabilityMicrosoft Windows Server · Microsoft Windows Server,
FAQ
Microsoft KEV questions.
How many Microsoft vulnerabilities are in CISA KEV?
390 Microsoft vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 42 of them added in the last 12 months. The newest is CVE-2026-96951 (Microsoft Windows Command Injection Vulnerability), added 2026-10-13.
Which Microsoft products are in CISA KEV?
71 products, including Windows, SharePoint, SQL Server. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Microsoft KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 117 of the 390 Microsoft entries.