Microsoft known exploited vulnerabilities
Every Microsoft CVE on CISA's Known Exploited Vulnerabilities catalog, newest addition first: 390 in all, 42 added in the last 12 months.
- CVE-2014-2817Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation
- CVE-2013-7331The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathna
- CVE-2013-3896Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote at
- CVE-2013-0074Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which
- CVE-2018-8611An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel ElevaMicrosoft Windows
- CVE-2017-8543Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, WinMicrosoft Windows
- CVE-2017-0210An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an Microsoft Internet Explorer
- CVE-2017-0149Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) vMicrosoft Internet Explorer
- CVE-2017-0147The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold anMicrosoft Windows SMB
- CVE-2017-0022Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 Microsoft XML Core Services
- CVE-2017-0005The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Microsoft Windows GDI
- CVE-2016-3351Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, a
- CVE-2016-3298Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Window
- CVE-2016-0162Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Inter
- CVE-2020-1027An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation oMicrosoft Windows
- CVE-2020-0638An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an atMicrosoft Windows
- CVE-2019-1385An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resultiMicrosoft Windows
- CVE-2019-1130An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows ElMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0880A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of PrivilegMicrosoft Windows Server · Microsoft Windows
- CVE-2019-0703An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB InformationMicrosoft Windows
- CVE-2019-0676An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully explMicrosoft Internet Explorer
- CVE-2018-8589An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of PrivileMicrosoft Windows Server · Microsoft Windows
- CVE-2014-4113win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7
- CVE-2014-0322Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving
- CVE-2022-26904Windows User Profile Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-21919Windows User Profile Service Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-41357Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2021-40450Win32k Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-22718Windows Print Spooler Elevation of Privilege VulnerabilityMicrosoft Windows
- CVE-2022-24521Windows Common Log File System Driver Elevation of Privilege VulnerabilityMicrosoft Windows
Get alerts for new known exploited vulnerabilities
Only want the packages you use? Check a lockfile to get a feed for your stack.
https://cve.now/kev/feed
Paste into Feedly or any RSS reader, or run /feed subscribe https://cve.now/kev/feed in Slack. For email alerts, give it to an RSS-to-email service.
https://cve.now/kev/feed?format=atom
The same entries as Atom, for readers that prefer it.
https://cve.now/kev/feed?format=json
The same entries as JSON Feed 1.1, for scripts and readers that support it.
https://cve.now/api/v1/entries?filter=kev
Pages of 30 entries, newest first. Pass the response's nextCursor as cursor for the next page.
Frequently asked questions
How many Microsoft vulnerabilities are in CISA KEV?
390 Microsoft vulnerabilities are on CISA's Known Exploited Vulnerabilities catalog, 42 of them added in the last 12 months. The newest is CVE-2026-96951 (Microsoft Windows Command Injection Vulnerability), added 2026-10-13.
Which Microsoft products are in CISA KEV?
71 products, including Windows, SharePoint, SQL Server. Attackers have exploited every one of these entries in the wild, and US federal agencies must patch each by its CISA due date.
Are Microsoft KEV vulnerabilities used by ransomware?
CISA knows ransomware campaigns exploit 117 of the 390 Microsoft entries.