Security Digest · page 1 of 2
Microsoft: known exploited vulnerabilities
122 Microsoft CVEs CISA has confirmed as exploited in the wild since October 2023. If you run these products, check each one.
| Added | CVE | Product and flaw | CISA due |
|---|---|---|---|
| 2026-10-13 | CVE-2026-96951 | Microsoft Windows Microsoft Windows Command Injection Vulnerability | 2026-10-16 |
| 2026-09-25 | CVE-2026-65660 | Microsoft SharePoint Microsoft SharePoint Code Injection Vulnerability | 2026-09-28 |
| 2026-09-08 | CVE-2026-85880 | Microsoft Windows Microsoft Windows Heap-Based Buffer Overflow Vulnerability | 2026-09-22 |
| 2026-09-08 | CVE-2026-81963 | Microsoft Windows Microsoft Windows Link Following Vulnerability | 2026-09-22 |
| 2026-08-26 | CVE-2019-1068 | Microsoft SQL Server Microsoft SQL Server Remote Code Execution Vulnerability | 2026-08-29 |
| 2026-08-18 | CVE-2026-55040 | Microsoft SharePoint Microsoft SharePoint Weak Authentication Vulnerability | 2026-08-21 |
| 2026-08-18 | CVE-2026-33824 | Microsoft Internet Key Exchange (IKE) Service Extensions Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability | 2026-08-21 |
| 2026-08-11 | CVE-2026-68820 | Microsoft Windows Ancillary Function Driver for WinSock Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | 2026-08-25 |
| 2026-07-22 | CVE-2026-50522 | Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 2026-07-25 |
| 2026-07-16 | CVE-2026-58644 | Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 2026-07-19 |
| 2026-07-14 | CVE-2026-56164 | Microsoft SharePoint Server Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability | 2026-07-17 |
| 2026-07-14 | CVE-2026-56155 | Microsoft Active Directory Federation Services Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability | 2026-07-28 |
| 2026-07-01 | CVE-2026-45659 | Microsoft SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability Ransomware | 2026-07-04 |
| 2026-05-20 | CVE-2026-45498 | Microsoft Defender Microsoft Defender Denial of Service Vulnerability | 2026-06-03 |
| 2026-05-20 | CVE-2026-41091 | Microsoft Defender Microsoft Defender Link Following Vulnerability | 2026-06-03 |
| 2026-05-20 | CVE-2010-0806 | Microsoft Internet Explorer Microsoft Internet Explorer Use-After-Free Vulnerability | 2026-06-03 |
| 2026-05-20 | CVE-2010-0249 | Microsoft Internet Explorer Microsoft Internet Explorer Use-After-Free Vulnerability | 2026-06-03 |
| 2026-05-20 | CVE-2009-1537 | Microsoft DirectX Microsoft DirectX NULL Byte Overwrite Vulnerability | 2026-06-03 |
| 2026-05-20 | CVE-2008-4250 | Microsoft Windows Microsoft Windows Buffer Overflow Vulnerability | 2026-06-03 |
| 2026-05-15 | CVE-2026-42897 | Microsoft Microsoft Microsoft Exchange Server Cross-Site Scripting Vulnerability | 2026-05-29 |
| 2026-04-28 | CVE-2026-32202 | Microsoft Windows Microsoft Windows Protection Mechanism Failure Vulnerability | 2026-05-12 |
| 2026-04-22 | CVE-2026-33825 | Microsoft Defender Microsoft Defender Insufficient Granularity of Access Control Vulnerability Ransomware | 2026-05-06 |
| 2026-04-14 | CVE-2026-32201 | Microsoft SharePoint Server Microsoft SharePoint Server Improper Input Validation Vulnerability | 2026-04-28 |
| 2026-04-14 | CVE-2009-0238 | Microsoft Office Microsoft Office Remote Code Execution | 2026-04-28 |
| 2026-04-13 | CVE-2025-60710 | Microsoft Windows Microsoft Windows Link Following Vulnerability Ransomware | 2026-04-27 |
| 2026-04-13 | CVE-2023-36424 | Microsoft Windows Microsoft Windows Out-of-Bounds Read Vulnerability | 2026-04-27 |
| 2026-04-13 | CVE-2023-21529 | Microsoft Exchange Server Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability Ransomware | 2026-04-27 |
| 2026-04-13 | CVE-2012-1854 | Microsoft Visual Basic for Applications (VBA) Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability | 2026-04-27 |
| 2026-03-18 | CVE-2026-20963 | Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 2026-03-21 |
| 2026-02-17 | CVE-2008-0015 | Microsoft Windows Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability | 2026-03-10 |
| 2026-02-12 | CVE-2024-43468 | Microsoft Configuration Manager Microsoft Configuration Manager SQL Injection Vulnerability | 2026-03-05 |
| 2026-02-10 | CVE-2026-21533 | Microsoft Windows Microsoft Windows Improper Privilege Management Vulnerability | 2026-03-03 |
| 2026-02-10 | CVE-2026-21525 | Microsoft Windows Microsoft Windows NULL Pointer Dereference Vulnerability | 2026-03-03 |
| 2026-02-10 | CVE-2026-21519 | Microsoft Windows Microsoft Windows Type Confusion Vulnerability | 2026-03-03 |
| 2026-02-10 | CVE-2026-21514 | Microsoft Office Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability | 2026-03-03 |
| 2026-02-10 | CVE-2026-21513 | Microsoft Windows Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability | 2026-03-03 |
| 2026-02-10 | CVE-2026-21510 | Microsoft Windows Microsoft Windows Shell Protection Mechanism Failure Vulnerability | 2026-03-03 |
| 2026-01-26 | CVE-2026-21509 | Microsoft Office Microsoft Office Security Feature Bypass Vulnerability | 2026-02-16 |
| 2026-01-13 | CVE-2026-20805 | Microsoft Windows Microsoft Windows Information Disclosure Vulnerability | 2026-02-03 |
| 2026-01-07 | CVE-2009-0556 | Microsoft Office Microsoft Office PowerPoint Code Injection Vulnerability | 2026-01-28 |
| 2025-12-09 | CVE-2025-62221 | Microsoft Windows Microsoft Windows Use After Free Vulnerability | 2025-12-30 |
| 2025-11-12 | CVE-2025-62215 | Microsoft Windows Microsoft Windows Race Condition Vulnerability | 2025-12-03 |
| 2025-10-24 | CVE-2025-59287 | Microsoft Windows Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability | 2025-11-14 |
| 2025-10-20 | CVE-2025-33073 | Microsoft Windows Microsoft Windows SMB Client Improper Access Control Vulnerability | 2025-11-10 |
| 2025-10-14 | CVE-2025-59230 | Microsoft Windows Microsoft Windows Improper Access Control Vulnerability | 2025-11-04 |
| 2025-10-14 | CVE-2025-24990 | Microsoft Windows Microsoft Windows Untrusted Pointer Dereference Vulnerability | 2025-11-04 |
| 2025-10-06 | CVE-2021-43226 | Microsoft Windows Microsoft Windows Privilege Escalation Vulnerability Ransomware | 2025-10-27 |
| 2025-10-06 | CVE-2013-3918 | Microsoft Windows Microsoft Windows Out-of-Bounds Write Vulnerability | 2025-10-27 |
| 2025-10-06 | CVE-2011-3402 | Microsoft Windows Microsoft Windows Remote Code Execution Vulnerability | 2025-10-27 |
| 2025-10-06 | CVE-2010-3962 | Microsoft Internet Explorer Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability | 2025-10-27 |
| 2025-08-12 | CVE-2013-3893 | Microsoft Internet Explorer Microsoft Internet Explorer Resource Management Errors Vulnerability | 2025-09-02 |
| 2025-08-12 | CVE-2007-0671 | Microsoft Office Microsoft Office Excel Remote Code Execution Vulnerability | 2025-09-02 |
| 2025-07-22 | CVE-2025-49706 | Microsoft SharePoint Microsoft SharePoint Improper Authentication Vulnerability Ransomware | 2025-07-23 |
| 2025-07-22 | CVE-2025-49704 | Microsoft SharePoint Microsoft SharePoint Code Injection Vulnerability Ransomware | 2025-07-23 |
| 2025-07-20 | CVE-2025-53770 | Microsoft SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Ransomware | 2025-07-21 |
| 2025-06-10 | CVE-2025-33053 | Microsoft Windows Microsoft Windows External Control of File Name or Path Vulnerability | 2025-07-01 |
| 2025-05-13 | CVE-2025-32709 | Microsoft Windows Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | 2025-06-03 |
| 2025-05-13 | CVE-2025-32706 | Microsoft Windows Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability | 2025-06-03 |
| 2025-05-13 | CVE-2025-32701 | Microsoft Windows Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability | 2025-06-03 |
| 2025-05-13 | CVE-2025-30400 | Microsoft Windows Microsoft Windows DWM Core Library Use-After-Free Vulnerability | 2025-06-03 |
| 2025-05-13 | CVE-2025-30397 | Microsoft Windows Microsoft Windows Scripting Engine Type Confusion Vulnerability | 2025-06-03 |
| 2025-04-17 | CVE-2025-24054 | Microsoft Windows Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability | 2025-05-08 |
| 2025-04-08 | CVE-2025-29824 | Microsoft Windows Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability Ransomware | 2025-04-29 |
| 2025-03-11 | CVE-2025-26633 | Microsoft Windows Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability Ransomware | 2025-04-01 |
| 2025-03-11 | CVE-2025-24993 | Microsoft Windows Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability | 2025-04-01 |
| 2025-03-11 | CVE-2025-24991 | Microsoft Windows Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability | 2025-04-01 |
| 2025-03-11 | CVE-2025-24985 | Microsoft Windows Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability | 2025-04-01 |
| 2025-03-11 | CVE-2025-24984 | Microsoft Windows Microsoft Windows NTFS Information Disclosure Vulnerability | 2025-04-01 |
| 2025-03-11 | CVE-2025-24983 | Microsoft Windows Microsoft Windows Win32k Use-After-Free Vulnerability | 2025-04-01 |
| 2025-03-03 | CVE-2018-8639 | Microsoft Windows Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability Ransomware | 2025-03-24 |
| 2025-02-25 | CVE-2024-49035 | Microsoft Partner Center Microsoft Partner Center Improper Access Control Vulnerability | 2025-03-18 |
| 2025-02-21 | CVE-2025-24989 | Microsoft Power Pages Microsoft Power Pages Improper Access Control Vulnerability | 2025-03-14 |
| 2025-02-11 | CVE-2025-21418 | Microsoft Windows Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability | 2025-03-04 |
| 2025-02-11 | CVE-2025-21391 | Microsoft Windows Microsoft Windows Storage Link Following Vulnerability | 2025-03-04 |
| 2025-02-06 | CVE-2024-21413 | Microsoft Office Outlook Microsoft Outlook Improper Input Validation Vulnerability | 2025-02-27 |
| 2025-02-04 | CVE-2024-29059 | Microsoft .NET Framework Microsoft .NET Framework Information Disclosure Vulnerability | 2025-02-25 |
| 2025-01-14 | CVE-2025-21335 | Microsoft Windows Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability | 2025-02-04 |
| 2025-01-14 | CVE-2025-21334 | Microsoft Windows Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability | 2025-02-04 |
| 2025-01-14 | CVE-2025-21333 | Microsoft Windows Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability | 2025-02-04 |
| 2024-12-16 | CVE-2024-35250 | Microsoft Windows Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability | 2025-01-06 |
| 2024-12-10 | CVE-2024-49138 | Microsoft Windows Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability | 2024-12-31 |
| 2024-11-12 | CVE-2024-49039 | Microsoft Windows Microsoft Windows Task Scheduler Privilege Escalation Vulnerability Ransomware | 2024-12-03 |
| 2024-11-12 | CVE-2024-43451 | Microsoft Windows Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability | 2024-12-03 |
| 2024-10-22 | CVE-2024-38094 | Microsoft SharePoint Microsoft SharePoint Deserialization Vulnerability Ransomware | 2024-11-12 |
| 2024-10-15 | CVE-2024-30088 | Microsoft Windows Microsoft Windows Kernel TOCTOU Race Condition Vulnerability Ransomware | 2024-11-05 |
| 2024-10-08 | CVE-2024-43573 | Microsoft Windows Microsoft Windows MSHTML Platform Spoofing Vulnerability | 2024-10-29 |
| 2024-10-08 | CVE-2024-43572 | Microsoft Windows Microsoft Windows Management Console Remote Code Execution Vulnerability | 2024-10-29 |
| 2024-09-18 | CVE-2020-0618 | Microsoft SQL Server Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability Ransomware | 2024-10-09 |
| 2024-09-16 | CVE-2024-43461 | Microsoft Windows Microsoft Windows MSHTML Platform Spoofing Vulnerability | 2024-10-07 |
| 2024-09-10 | CVE-2024-38226 | Microsoft Publisher Microsoft Publisher Protection Mechanism Failure Vulnerability | 2024-10-01 |
| 2024-09-10 | CVE-2024-38217 | Microsoft Windows Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability | 2024-10-01 |
| 2024-09-10 | CVE-2024-38014 | Microsoft Windows Microsoft Windows Installer Improper Privilege Management Vulnerability | 2024-10-01 |
| 2024-08-21 | CVE-2021-31196 | Microsoft Exchange Server Microsoft Exchange Server Information Disclosure Vulnerability | 2024-09-11 |
| 2024-08-13 | CVE-2024-38213 | Microsoft Windows Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | 2024-09-03 |
| 2024-08-13 | CVE-2024-38193 | Microsoft Windows Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability | 2024-09-03 |
| 2024-08-13 | CVE-2024-38189 | Microsoft Project Microsoft Project Remote Code Execution Vulnerability | 2024-09-03 |
| 2024-08-13 | CVE-2024-38178 | Microsoft Windows Microsoft Windows Scripting Engine Memory Corruption Vulnerability | 2024-09-03 |
| 2024-08-13 | CVE-2024-38107 | Microsoft Windows Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability | 2024-09-03 |
| 2024-08-13 | CVE-2024-38106 | Microsoft Windows Microsoft Windows Kernel Privilege Escalation Vulnerability | 2024-09-03 |
| 2024-08-05 | CVE-2018-0824 | Microsoft Windows Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability | 2024-08-26 |