Microsoft CVEs
14,257 CVEs and advisories name Microsoft as an affected vendor, 292 of them on CISA's Known Exploited Vulnerabilities catalog, newest first. Follow it as a feed.
- CVE-2026-45322OS Command Injection in Microsoft UFO Shell Action Replay via Stored Session JSON
- CVE-2026-23663Microsoft Global Secure Access (GSA) Information Disclosure Vulnerability
- CVE-2026-42901Microsoft Entra ID Elevation of Privilege Vulnerability
- CVE-2026-41104Microsoft Planetary Computer Pro Information Disclosure Vulnerability
- CVE-2026-45659Microsoft SharePoint Remote Code Execution Vulnerability
- CVE-2026-33843Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability
- CVE-2026-26147Azure Stack HCI Information Disclosure Vulnerability
- CVE-2026-41090Microsoft Copilot Tampering Vulnerability
- CVE-2026-42827M365 Copilot Information Disclosure Vulnerability
- CVE-2026-47280Azure Resource Manager Elevation of Privilege Vulnerability
- CVE-2026-40411Azure Virtual Network Gateway Remote Code Execution Vulnerability
- CVE-2026-35430Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability
- CVE-2026-23652Microsoft Power Pages Remote Code Execution Vulnerability
- CVE-2026-40412Azure Orbital Spatio Remote Code Execution Vulnerability
- CVE-2026-42834Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability
- CVE-2026-45584Microsoft Defender Remote Code Execution Vulnerability
- CVE-2026-41091Microsoft Defender Elevation of Privilege Vulnerability
- CVE-2026-45498Microsoft Defender Denial of Service Vulnerability
- CVE-2026-45585Windows BitLocker Security Feature Bypass Vulnerability
- CVE-2026-42822Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability
- CVE-2026-45495Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability
- CVE-2026-45494Microsoft Edge (Chromium-based) Spoofing Vulnerability
- CVE-2026-45492Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability
- CVE-2026-46383Microsoft APM: Windows absolute-path tar member overwrite during legacy-bundle probing in `apm install`
- CVE-2026-45539Microsoft APM: Symlinks under `.apm/prompts/` and `.apm/agents/` are dereferenced during `apm install`, copying host-local file contents into the project tree
- CVE-2026-44641Microsoft APM: plugin.json component paths escape plugin root and copy arbitrary host files during install
- CVE-2026-41615Microsoft Authenticator Information Disclosure Vulnerability
- CVE-2026-42897Microsoft Exchange Server Spoofing Vulnerability
- CVE-2026-44503Kiota abstractions RedirectHandler leaks Cookie/Proxy-Authorization headers on cross-host redirect
- CVE-2026-33821Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability