Microsoft CVEs
14,257 CVEs and advisories name Microsoft as an affected vendor, 292 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-66800Azure Data Factory Information Disclosure Vulnerability
- CVE-2026-66309Azure SQL Database Elevation of Privilege Vulnerability
- CVE-2026-65816Azure Arc Elevation of Privilege Vulnerability
- CVE-2026-63509Microsoft Fabric Elevation of Privilege Vulnerability
- CVE-2026-65770Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability
- CVE-2026-70105Microsoft Word Information Disclosure Vulnerability
- CVE-2026-55013Windows Remote Help Defense Spoofing Vulnerability
- CVE-2026-55015Microsoft Remote Help Denial of Service Vulnerability
- CVE-2026-69836Microsoft Entra ID Remote Code Execution Vulnerability
- CVE-2026-69851Microsoft Entra ID Elevation of Privilege Vulnerability
- CVE-2026-69519Azure Stack HCI Information Disclosure Vulnerability
- CVE-2026-68789Azure SQL Database Elevation of Privilege Vulnerability
- CVE-2026-65801Microsoft Exchange Online Elevation of Privilege Vulnerability
- CVE-2026-62834Azure Data Factory Elevation of Privilege Vulnerability
- CVE-2026-69550Windows App for Mac Information Disclosure Vulnerability
- CVE-2026-62727Windows Telephony Service Elevation of Privilege Vulnerability
- CVE-2026-24301Microsoft Copilot Information Disclosure Vulnerability
- CVE-2026-73851Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)
- CVE-2026-69414Microsoft Defender Elevation of Privilege Vulnerability
- CVE-2026-50523Microsoft PowerShell Remote Code Execution Vulnerability
- CVE-2026-72970Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-73299Prompty: Server-Side Template Injection to Remote Code Execution in the @prompty/core Nunjucks Renderer
- CVE-2026-73298Microsoft Container Migration Solution Accelerator: Authenticated IDOR allowing read/write/delete processes
- CVE-2026-73297Microsoft UFO: IPv6 transition address bypass of SSRF guard in URL validation
- CVE-2026-73296Microsoft UFO: Unauthenticated Mobile MCP access allows remote Android device control and screen disclosure
- CVE-2026-70339Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-65680Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
- CVE-2026-62869Azure Entra ID Spoofing Vulnerability
- CVE-2026-50516Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability
- CVE-2026-62917Microsoft SharePoint Server Spoofing Vulnerability