CyberSIXT Search
Vendor

Microsoft

No CISA KEV deadline is open. CISA last added a Microsoft CVE on 13 Oct.

Tracked since 26 Jan · latest article Mon 26 Oct · RSS

No product called by that name is recorded for this vendor.

Added to KEV · 90 days
8
of 390 all time
High exploit odds · current
10
EPSS top 5%, not in KEV

Exploited, by due date

CSV download
CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2026-96951Windows13 OctDeadline passed 16 Oct13 articles
CVE-2026-65660SharePoint25 SepDeadline passed 28 Sep5 articles
CVE-2026-81963Windows8 SepDeadline passed 22 Sep14 articles
CVE-2026-85880Windows8 SepDeadline passed 22 Sep22 articles
CVE-2019-1068SQL Server26 AugDeadline passed 29 Aug9 articles
CVE-2026-33824Internet Key Exchange (IKE) Service Extensions18 AugDeadline passed 21 Aug14 articles
CVE-2026-55040SharePoint18 AugDeadline passed 21 Aug16 articles
CVE-2026-68820Windows Ancillary Function Driver for WinSock11 AugDeadline passed 25 Aug17 articles
CVE-2026-50522SharePoint22 JulDeadline passed 25 Jul10 articles
CVE-2026-58644SharePoint16 JulDeadline passed 19 Jul14 articles
50 earlier entries
CVE-2026-56164SharePoint Server14 JulDeadline passed 17 Jul11 articles
CVE-2026-56155Active Directory Federation Services14 JulDeadline passed 28 Jul7 articles
CVE-2026-45659SharePoint Server1 JulDeadline passed 4 JulKnown ransomware use · 12 articles
CVE-2008-4250Windows20 MayDeadline passed 3 Jun4 articles
CVE-2009-1537DirectX20 MayDeadline passed 3 Jun4 articles
CVE-2010-0249Internet Explorer20 MayDeadline passed 3 Jun4 articles
CVE-2010-0806Internet Explorer20 MayDeadline passed 3 Jun4 articles
CVE-2026-41091Defender20 MayDeadline passed 3 Jun7 articles
CVE-2026-45498Defender20 MayDeadline passed 3 Jun4 articles
CVE-2026-42897Microsoft15 MayDeadline passed 29 May14 articles
CVE-2026-32202Windows28 AprDeadline passed 12 May6 articles
CVE-2026-33825Defender22 AprDeadline passed 6 MayKnown ransomware use · 17 articles
CVE-2009-0238Office14 AprDeadline passed 28 Apr3 articles
CVE-2026-32201SharePoint Server14 AprDeadline passed 28 Apr14 articles
CVE-2012-1854Visual Basic for Applications (VBA)13 AprDeadline passed 27 Apr4 articles
CVE-2023-21529Exchange Server13 AprDeadline passed 27 AprKnown ransomware use · 7 articles
CVE-2023-36424Windows13 AprDeadline passed 27 Apr5 articles
CVE-2025-60710Windows13 AprDeadline passed 27 AprKnown ransomware use · 5 articles
CVE-2026-20963SharePoint18 MarDeadline passed 21 Mar5 articles
CVE-2008-0015Windows17 FebDeadline passed 10 Mar2 articles
CVE-2024-43468Configuration Manager12 FebDeadline passed 5 Mar3 articles
CVE-2026-21510Windows10 FebDeadline passed 3 Mar11 articles
CVE-2026-21513Windows10 FebDeadline passed 3 Mar15 articles
CVE-2026-21514Office10 FebDeadline passed 3 Mar9 articles
CVE-2026-21519Windows10 FebDeadline passed 3 Mar7 articles
CVE-2026-21525Windows10 FebDeadline passed 3 Mar7 articles
CVE-2026-21533Windows10 FebDeadline passed 3 Mar7 articles
CVE-2026-21509Office26 JanDeadline passed 16 Feb22 articles
CVE-2026-20805not in CyberSIXT coverageWindows13 JanDeadline passed 3 Feb
CVE-2009-0556not in CyberSIXT coverageOffice7 JanDeadline passed 28 Jan
CVE-2025-62221Windows9 Dec 2025Deadline passed 30 Dec 20251 article
CVE-2025-62215not in CyberSIXT coverageWindows12 Nov 2025Deadline passed 3 Dec 2025
CVE-2025-59287not in CyberSIXT coverageWindows24 Oct 2025Deadline passed 14 Nov 2025
CVE-2025-33073Windows20 Oct 2025Deadline passed 10 Nov 20251 article
CVE-2025-24990not in CyberSIXT coverageWindows14 Oct 2025Deadline passed 4 Nov 2025
CVE-2025-59230not in CyberSIXT coverageWindows14 Oct 2025Deadline passed 4 Nov 2025
CVE-2010-3962not in CyberSIXT coverageInternet Explorer6 Oct 2025Deadline passed 27 Oct 2025
CVE-2011-3402not in CyberSIXT coverageWindows6 Oct 2025Deadline passed 27 Oct 2025
CVE-2013-3918not in CyberSIXT coverageWindows6 Oct 2025Deadline passed 27 Oct 2025
CVE-2021-43226not in CyberSIXT coverageWindows6 Oct 2025Deadline passed 27 Oct 2025Known ransomware use
CVE-2007-0671not in CyberSIXT coverageOffice12 Aug 2025Deadline passed 2 Sep 2025
CVE-2013-3893not in CyberSIXT coverageInternet Explorer12 Aug 2025Deadline passed 2 Sep 2025
CVE-2025-49704SharePoint22 Jul 2025Deadline passed 23 Jul 2025Known ransomware use · 1 article
CVE-2025-49706SharePoint22 Jul 2025Deadline passed 23 Jul 2025Known ransomware use · 1 article
CVE-2025-53770SharePoint20 Jul 2025Deadline passed 21 Jul 2025Known ransomware use · 3 articles
CVE-2025-33053not in CyberSIXT coverageWindows10 Jun 2025Deadline passed 1 Jul 2025
CVE-2025-30397not in CyberSIXT coverageWindows13 May 2025Deadline passed 3 Jun 2025
CVE-2025-30400not in CyberSIXT coverageWindows13 May 2025Deadline passed 3 Jun 2025
CVE-2025-32701not in CyberSIXT coverageWindows13 May 2025Deadline passed 3 Jun 2025
CVE-2025-32706not in CyberSIXT coverageWindows13 May 2025Deadline passed 3 Jun 2025

The first 60 entries are listed. The CSV includes the full vendor catalogue.

Products

40 products · 159 CVEs in coverage
Windows58 CVEs · 176 in KEVlatest 22 OctInternet Explorer2 CVEs · 37 in KEVlatest 21 MayOffice4 CVEs · 30 in KEVlatest 20 OctWin32k0 CVEs · 25 in KEVExchange Server8 CVEs · 17 in KEVlatest 6 Oct
35 more productsSharePoint16 CVEs · 15 in KEVlatest 14 OctDefender5 CVEs · 6 in KEVlatest 10 SepEdge2 CVEs · 4 in KEVlatest 14 OctWord0 CVEs · 4 in KEVOpen Management Infrastructure0 CVEs · 4 in KEV.NET Framework1 CVE · 3 in KEVlatest 14 OctActive Directory1 CVE · 3 in KEVlatest 11 MayExcel0 CVEs · 3 in KEVSilverlight0 CVEs · 3 in KEVSQL Server4 CVEs · 2 in KEVlatest 14 OctSMBv11 CVE · 2 in KEVlatest 12 MayPowerPoint0 CVEs · 2 in KEVXML Core Services0 CVEs · 2 in KEVGraphics Device Interface0 CVEs · 2 in KEVSMBv1 server0 CVEs · 2 in KEVDirectX Graphics Kernel0 CVEs · 2 in KEVMSHTML0 CVEs · 2 in KEVEnhanced Cryptographic Provider0 CVEs · 2 in KEVConfiguration Manager2 CVEs · 1 in KEVlatest 20 AugRemote Desktop Services1 CVE · 1 in KEVlatest 21 SepInternet Key Exchange (IKE) Service Extensions1 CVE · 1 in KEVlatest 19 AugActive Directory Federation Services1 CVE · 1 in KEVlatest 15 JulDirectX1 CVE · 1 in KEVlatest 21 MayVisual Basic for Applications1 CVE · 1 in KEVlatest 14 AprForefront Threat Management Gateway0 CVEs · 1 in KEVAncillary Function Driver0 CVEs · 1 in KEVMSCOMCTL.OCX0 CVEs · 1 in KEVWinVerifyTrust function0 CVEs · 1 in KEVGraphics Component0 CVEs · 1 in KEVInput Method Editor (IME) Japanese0 CVEs · 1 in KEVKerberos Key Distribution Center0 CVEs · 1 in KEVHTTP.sys0 CVEs · 1 in KEVATM Font Driver0 CVEs · 1 in KEVClient-Server Run-time Subsystem0 CVEs · 1 in KEVInternet Information Services0 CVEs · 1 in KEV

Coverage

368 articles · all timeFull timeline

368 articles from 20 outlets; 4 in the last 7 days.

Microsoft: coverage over time368 articles from 20 outlets. Busiest week: 29 articles, week of 7 Sep. 4 in the last 7 days. Microsoft: coverage over time368 articles from 20 outlets. Busiest week: 29 articles, week of 7 Sep. 4 in the last 7 days.
  • Article
  • Official notice
Show as table
Microsoft: articles
Published (UTC)OutletHeadline
Mon 26 Oct · 03:19 UTCSecurityOnlineMicrosoft issues out of band .NET fixes for four flaws
Thu 22 Oct · 11:41 UTCSecurityOnlineAPT41 Uses a BlackX UEFI Bootkit to Bypass Secure Boot in Central Asia
Thu 22 Oct · 06:07 UTCSecurelistBlackX UEFI bootkit targets Central Asian diplomats via Secure Boot flaw
Tue 20 Oct · 12:31 UTCThe Hacker NewsAPT28 Breaches NATO Naval Shipbuilder and Steals Credentials in Week-Long Intrusion
Wed 14 Oct · 21:41 UTCSecurity AffairsCISA Flags Actively Exploited Windows Flaw That Bypasses Security Protections
Wed 14 Oct · 14:37 UTCSecurity AffairsMicrosoft fixes 1,415 flaws as exploited Windows bug puts users at risk
Wed 14 Oct · 12:11 UTCMalwarebytesMicrosoft Patches Record 1,413 Flaws, Including Exploited Windows Zero Day
Wed 14 Oct · 09:14 UTCInfosecurityMicrosoft Fixes Record 1,411 Flaws as Patch Tuesday Strain Grows
Wed 14 Oct · 08:01 UTCSecurityOnlineBroadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw Discovery
Wed 14 Oct · 07:31 UTCSecurityWeekMicrosoft’s record 1,413 fixes include a Windows flaw exploited to bypass security warnings
Wed 14 Oct · 07:01 UTCThe Hacker NewsWindows Defender flaw let attackers bypass a protected enclave
Wed 14 Oct · 05:14 UTCThe Hacker NewsMicrosoft patches 1,413 flaws as hackers exploit Windows bug
Wed 14 Oct · 04:37 UTCSecurityOnlineMicrosoft Fixes Actively Exploited Windows Flaw in Record Patch Release
Wed 14 Oct · 04:37 UTCSecurityOnlineMicrosoft patches Copilot flaw that could let attackers run code via files
Wed 14 Oct · 00:03 UTCCISACISA flags actively exploited Windows flaw with 16 October patch deadline
Wed 14 Oct · 00:01 UTCKrebs on SecurityMicrosoft fixes over 1,400 flaws, including a Windows zero day
Tue 13 Oct · 23:31 UTCRapid7Microsoft Patches Windows Shell Zero Day Exploited in the Wild
Tue 13 Oct · 23:01 UTCDark ReadingMicrosoft patches actively exploited Windows flaw that bypasses security checks
Tue 13 Oct · 21:13 UTCthezdi.comAdobe and Microsoft Patch Thousands of Flaws in Record Update
Tue 6 Oct · 14:27 UTCSecurity AffairsMicrosoft Patches Exchange Flaw That Could Expose Staff Mailboxes
Mon 5 Oct · 17:58 UTCThe Hacker NewsMicrosoft Patches Exchange Flaw That Exposes Colleagues’ Mailboxes
Sat 3 Oct · 03:00 UTCSecurityOnlineMicrosoft Reissues Exchange Updates With New CVE-2026-96940 Flaw
Fri 2 Oct · 10:05 UTCSecurityWeekWarlock Ransomware Expands SharePoint Attacks Against Critical Sectors
Sun 27 Sep · 09:46 UTCSecurityWeekAttackers Exploit Patched Microsoft SharePoint Flaw to Deploy Webshells
Fri 25 Sep · 21:31 UTCSecurity AffairsCISA Warns of Active MikroTik RouterOS Attacks and SharePoint Flaw
Fri 25 Sep · 17:00 UTCCISACISA Flags Actively Exploited SharePoint and MikroTik Flaws
Fri 25 Sep · 16:01 UTCCISACISA Warns of Actively Exploited Microsoft SharePoint Code Flaw
Fri 25 Sep · 08:23 UTCSecurityOnlineAttackers Exploit SharePoint Flaw to Deploy Stealthy Web Shells
Thu 24 Sep · 09:59 UTCSecurityOnlineChinese Hackers Exploited Chrome and Windows Zero Days in Espionage Attacks
Mon 21 Sep · 09:13 UTCSecurity AffairsAI Agents Expose New Attack Paths Through Skills and Memory
Mon 21 Sep · 09:13 UTCSecurityOnlineNightEagle Hackers Target Russian Firms With GhostContainer Backdoor
Fri 18 Sep · 11:23 UTCSecurityWeekMicrosoft Fixes 18 Azure and Copilot Flaws, Urges Windows Update
Wed 16 Sep · 17:13 UTCDark ReadingBrowser Extensions Hijacked AI Assistants in Five Major Browsers
Wed 16 Sep · 10:11 UTCSecurelistNightEagle Hackers Hide Exchange Backdoor Behind Stolen VPN Access
Tue 15 Sep · 11:30 UTCSecurity AffairsChina-Linked Groups Exploited Chrome Patch Gap to Target NGOs
Tue 15 Sep · 04:41 UTCSecurityOnlineMicrosoft Fixes Windows 11 RDS Failures and CVE-2026-62721
Sat 12 Sep · 11:30 UTCSecurityWeekChrome Zero Days Fuel BlueMoon Exploit Kit’s Espionage Surge
Thu 10 Sep · 17:25 UTCSecurityOnlineChrome Zero Day Chain Targeted NGOs Before Google’s Patch Arrived
Thu 10 Sep · 16:12 UTCDark ReadingWindows Defender Patch Bypass Exposes SYSTEM Files to Attackers
Thu 10 Sep · 12:49 UTCSOCRadarPublic ShieldCrash PoC Claims to Bypass Microsoft Defender Fix
Thu 10 Sep · 08:37 UTCSecurity AffairsCISA Warns of Exploited Magento Flaw Enabling Remote Code Execution
Thu 10 Sep · 07:30 UTCSecurityWeekMicrosoft Defender Zero Day Bypasses Patches to Expose Windows Systems
Thu 10 Sep · 07:00 UTCSecurity AffairsChrome and Windows Zero Days Fuel BlueMoon Espionage Campaigns
Wed 9 Sep · 21:06 UTCArs TechnicaBlueMoon Exploit Kit Races to Exploit Fresh Chrome and Windows Flaws
Wed 9 Sep · 20:00 UTCThe Hacker NewsChrome Zero-Day Chain BlueMoon Drops Espionage Backdoors on Windows
Wed 9 Sep · 12:26 UTCSecurityOnlineChinese-Linked Spies Exploit Chrome and Windows Zero-Days
Wed 9 Sep · 10:38 UTCMalwarebytesMicrosoft Patches 964 CVEs as Two Windows Zero-Days Face Attacks
Wed 9 Sep · 10:00 UTCInfosecurityMicrosoft Patches Record 974 CVEs Amid Exploited Windows Zero-Days
Wed 9 Sep · 09:29 UTCThe Hacker NewsMicrosoft Defender Zero Day Bypasses Patch to Read Windows Files as SYSTEM
Wed 9 Sep · 08:50 UTCSecurity AffairsShieldCrash PoC Revives Microsoft Defender SYSTEM File Read Flaw

Who reported 20 outlets, last 12 months

  • SecurityOnline71
  • CISA57
  • Security Affairs54
  • SecurityWeek44
  • The Hacker News35
  • Dark Reading23
  • Others84
  1. Microsoft issues out of band .NET fixes for four flawsSecurityOnline
  2. APT41 Uses a BlackX UEFI Bootkit to Bypass Secure Boot in Central AsiaSecurityOnline
  3. BlackX UEFI bootkit targets Central Asian diplomats via Secure Boot flawSecurelist
  4. APT28 Breaches NATO Naval Shipbuilder and Steals Credentials in Week-Long IntrusionThe Hacker News
  5. CISA Flags Actively Exploited Windows Flaw That Bypasses Security ProtectionsSecurity Affairs
  6. Microsoft fixes 1,415 flaws as exploited Windows bug puts users at riskSecurity Affairs
  7. Microsoft Patches Record 1,413 Flaws, Including Exploited Windows Zero DayMalwarebytes
  8. Microsoft Fixes Record 1,411 Flaws as Patch Tuesday Strain GrowsInfosecurity
  9. Broadcom Moves VMware to Monthly Security Updates as AI Speeds Flaw DiscoverySecurityOnline
  10. Microsoft’s record 1,413 fixes include a Windows flaw exploited to bypass security warningsSecurityWeek

Named in the same articles

Threat actors · articles in common
APT28 16Lazarus Group 7APT31 5UNK_QuietRacket 3UNK_LateNight 3UNK_DoubleCheck 3

All CVEs in coverage

159
CVE-2019-0708Microsoft Remote Desktop Services Remote Code Execution VulnerabilityCVSS9.8CriticalExploited99.9%EPSS2articles
CVE-2025-53770Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited99.9%EPSS3articles
CVE-2025-49704Microsoft SharePoint Code Injection VulnerabilityCVSS8.8HighExploited99.9%EPSS1article
CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution VulnerabilityCVSS8.8HighExploited99.9%EPSS1article
CVE-2017-0144Microsoft SMBv1 Remote Code Execution VulnerabilityCVSS8.8HighExploited99.2%EPSS1article
CVE-2025-49706Microsoft SharePoint Improper Authentication VulnerabilityCVSS6.5MediumExploited99.0%EPSS1article
CVE-2008-4250Microsoft Windows Buffer Overflow VulnerabilityCVSS9.8CriticalExploited99%EPSS4articles
CVE-2018-0802Microsoft Office Memory Corruption VulnerabilityCVSSUnratedExploited93%EPSS1article
CVE-2010-0249Microsoft Internet Explorer Use-After-Free VulnerabilityCVSS8.8HighExploited92%EPSS4articles
CVE-2022-26923Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityCVSS8.8HighExploited84%EPSS1article
CVE-2025-33073Microsoft Windows SMB Client Improper Access Control VulnerabilityCVSS8.8HighExploited83%EPSS1article
CVE-2010-0806Microsoft Internet Explorer Use-After-Free VulnerabilityCVSS8.8HighExploited82%EPSS4articles
147 more CVEs
CVE-2024-43468Microsoft Configuration Manager SQL Injection VulnerabilityCVSS9.8CriticalExploited81%EPSS3articles
CVE-2026-33824Microsoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityCVSS9.8CriticalExploited77%EPSS14articles
CVE-2008-0015Microsoft Windows Video ActiveX Control Remote Code Execution VulnerabilityCVSSUnratedExploited77%EPSS2articles
CVE-2026-21509Microsoft Office Security Feature Bypass VulnerabilityCVSS7.8HighExploited71%EPSS22articles
CVE-2026-42897Microsoft Exchange Server Cross-Site Scripting VulnerabilityCVSS8.1HighExploited71%EPSS14articles
CVE-2026-55040Microsoft SharePoint Weak Authentication VulnerabilityCVSS9.1CriticalExploited70%EPSS16articles
CVE-2026-45498Microsoft Defender Denial of Service VulnerabilityCVSS4.0MediumExploited63%EPSS4articles
CVE-2026-21510Microsoft Windows Shell Protection Mechanism Failure VulnerabilityCVSS8.8HighExploited61%EPSS11articles
CVE-2023-21529Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityCVSS8.8HighExploited59%EPSS7articles
CVE-2019-1068Microsoft SQL Server Remote Code Execution VulnerabilityCVSS8.8HighExploited57%EPSS9articles
CVE-2009-1537Microsoft DirectX NULL Byte Overwrite VulnerabilityCVSS8.8HighExploited51%EPSS4articles
CVE-2026-32201Microsoft SharePoint Server Improper Input Validation VulnerabilityCVSS6.5MediumExploited43%EPSS14articles
CVE-2009-0238Microsoft Office Remote Code ExecutionCVSS8.8HighExploited43%EPSS3articles
CVE-2023-21674Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation VulnerabilityCVSS8.8HighExploited34%EPSS1article
CVE-2026-20963Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited29%EPSS5articles
CVE-2012-1854Microsoft Visual Basic for Applications Insecure Library Loading VulnerabilityCVSS7.8HighExploited21%EPSS4articles
CVE-2026-58644Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited16%EPSS14articles
CVE-2026-21513Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityCVSS8.8HighExploited16%EPSS15articles
CVE-2023-36424Microsoft Windows Out-of-Bounds Read VulnerabilityCVSS7.8HighExploited12%EPSS5articles
CVE-2026-96951Microsoft Windows Command Injection VulnerabilityCVSS8.8HighExploited9.8%EPSS13articles
CVE-2026-41091Microsoft Defender Link Following VulnerabilityCVSS7.8HighExploited8.2%EPSS7articles
CVE-2026-65660Microsoft SharePoint Code Injection VulnerabilityCVSS8.8HighExploited8.2%EPSS5articles
CVE-2026-33825Microsoft Defender Insufficient Granularity of Access Control VulnerabilityCVSS7.8HighExploited6.8%EPSS17articles
CVE-2026-32202Microsoft Windows Protection Mechanism Failure VulnerabilityCVSS4.3MediumExploited4.9%EPSS6articles
CVE-2026-21525Microsoft Windows NULL Pointer Dereference VulnerabilityCVSS6.2MediumExploited4.8%EPSS7articles
CVE-2025-60710Microsoft Windows Link Following VulnerabilityCVSS7.8HighExploited4.6%EPSS5articles
CVE-2026-21533Microsoft Windows Improper Privilege Management VulnerabilityCVSS7.8HighExploited4.2%EPSS7articles
CVE-2026-85880Microsoft Windows Heap-Based Buffer Overflow VulnerabilityCVSS7.8HighExploited3.6%EPSS22articles
CVE-2026-50522Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityCVSS9.8CriticalExploited3.0%EPSS10articles
CVE-2026-45659Microsoft SharePoint Server Deserialization of Untrusted Data VulnerabilityCVSS8.8HighExploited2.7%EPSS12articles
CVE-2025-62221Microsoft Windows Use After Free VulnerabilityCVSS7.8HighExploited2.5%EPSS1article
CVE-2026-21519Microsoft Windows Type Confusion VulnerabilityCVSS7.8HighExploited2.5%EPSS7articles
CVE-2026-21514Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision VulnerabilityCVSS7.8HighExploited1.6%EPSS9articles
CVE-2026-69836Microsoft Entra vulnerabilityCVSS10.0CriticalExploited1.5%EPSS3articles
CVE-2026-56164Microsoft SharePoint Server Missing Authentication for Critical Function VulnerabilityCVSS5.3MediumExploited1.0%EPSS11articles
CVE-2026-81963Microsoft Windows Link Following VulnerabilityCVSS7.8HighExploited0.4%EPSS14articles
CVE-2026-56155Microsoft Active Directory Federation Services Insufficient Granularity of Access Control VulnerabilityCVSS7.8HighExploited0.3%EPSS7articles
CVE-2026-68820Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityCVSS7.0HighExploited0.3%EPSS17articles
CVE-2025-53771Microsoft SharePoint Server Spoofing VulnerabilityCVSS6.5Medium–Not in KEV99.8%EPSS0articles
CVE-2026-41089Microsoft Windows Server 2012 vulnerabilityCVSS9.8Critical–Not in KEV80%EPSS9articles
CVE-2026-49160Microsoft Windows 10 Version 1607 vulnerabilityCVSS7.5High–Not in KEV57%EPSS7articles
CVE-2026-33112Microsoft SharePoint Enterprise Server 2016 vulnerabilityCVSS8.8High–Not in KEV31%EPSS1article
CVE-2026-47291Microsoft Windows 10 Version 1607 vulnerabilityCVSS9.8Critical–Not in KEV25%EPSS4articles
CVE-2020-17103Microsoft Windows 10 Version 1809 vulnerabilityCVSS7.0High–Not in KEV22%EPSS4articles
CVE-2026-45657Microsoft Windows 11 version 23H2 vulnerabilityCVSS9.8Critical–Not in KEV15%EPSS1article
CVE-2026-26119Windows Admin Center Elevation of Privilege VulnerabilityCVSSUnrated–Not in KEV11%EPSS1article
CVE-2026-40372Microsoft ASP.NET Core 10.0 vulnerabilityCVSS9.1Critical–Not in KEV11%EPSS3articles
CVE-2026-20841Windows Notepad App Remote Code Execution VulnerabilityCVSSUnrated–Not in KEV9.0%EPSS1article
CVE-2025-32711Microsoft 365 Copilot vulnerabilityCVSS9.3Critical–Not in KEV8.0%EPSS2articles
CVE-2026-42824Microsoft 365 Copilot vulnerabilityCVSS6.5Medium–Not in KEV7.6%EPSS1article
CVE-2026-42980Microsoft Windows 10 Version 1607 vulnerabilityCVSS7.8High–Not in KEV7.0%EPSS1article
CVE-2022-21894Microsoft Windows 10 Version 1809 vulnerabilityCVSS4.4Medium–Not in KEV6.8%EPSS2articles
CVE-2026-41103Microsoft Confluence SAML SSO plugin vulnerabilityCVSS9.1Critical–Not in KEV5.4%EPSS4articles
CVE-2026-50507Microsoft Windows 10 Version 1607 vulnerabilityCVSS6.8Medium–Not in KEV5.0%EPSS4articles
CVE-2026-24294Microsoft Windows 10 Version 1607 vulnerabilityCVSS7.8High–Not in KEV4.8%EPSS1article
CVE-2026-40369Microsoft Windows 11 Version 24H2 vulnerabilityCVSS7.8High–Not in KEV4.7%EPSS1article
CVE-2026-26030microsoft semantic-kernel vulnerabilityCVSS10.0Critical–Not in KEV3.9%EPSS1article
CVE-2026-45586Microsoft Windows 10 Version 1607 vulnerabilityCVSS7.8High–Not in KEV3.6%EPSS5articles
CVE-2026-96940Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilityCVSS8.8High–Not in KEV2.8%EPSS3articles
CVE-2026-41096Microsoft Windows 11 version 23H2 vulnerabilityCVSS9.8Critical–Not in KEV2.7%EPSS5articles
CVE-2026-25592Semantic Kernel has an Arbitrary File Write via AI Agent Function Calling in .NET SDKCVSS10.0Critical–Not in KEV2.6%EPSS2articles
CVE-2025-54100PowerShell Remote Code Execution VulnerabilityCVSSUnrated–Not in KEV2.2%EPSS1article
CVE-2026-26127.NET Denial of Service VulnerabilityCVSSUnrated–Not in KEV2.1%EPSS9articles
CVE-2026-21262SQL Server Elevation of Privilege VulnerabilityCVSSUnrated–Not in KEV2.1%EPSS9articles
CVE-2026-45585Microsoft Windows 11 Version 24H2 vulnerabilityCVSS6.8Medium–Not in KEV1.9%EPSS3articles
CVE-2025-29827Microsoft Azure Automation vulnerabilityCVSS9.9Critical–Not in KEV1.7%EPSS1article
CVE-2026-21536Microsoft Devices Pricing Program Remote Code Execution VulnerabilityCVSSUnrated–Not in KEV1.7%EPSS5articles
CVE-2023-36880Microsoft Edge (Chromium-based) vulnerabilityCVSS4.8Medium–Not in KEV1.6%EPSS1article
CVE-2026-21520Microsoft Copilot Studio vulnerabilityCVSS7.5High–Not in KEV1.5%EPSS1article
CVE-2026-70291Microsoft 365 Apps for Enterprise vulnerabilityCVSS9.8Critical–Not in KEV1.3%EPSS1article
CVE-2026-69414Microsoft Malware Protection Engine vulnerabilityCVSS7.8High–Not in KEV1.3%EPSS7articles
CVE-2026-26144Microsoft Excel Information Disclosure VulnerabilityCVSSUnrated–Not in KEV1.2%EPSS5articles
CVE-2026-42898Microsoft Dynamics 365 (on-premises) version 9.1 vulnerabilityCVSS9.9Critical–Not in KEV1.2%EPSS4articles
CVE-2026-45504Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilityCVSS8.8High–Not in KEV1.2%EPSS1article
CVE-2026-44815Microsoft Windows 10 Version 1607 vulnerabilityCVSS9.8Critical–Not in KEV1.1%EPSS1article
CVE-2026-26121Azure IOT Explorer Spoofing VulnerabilityCVSSUnrated–Not in KEV1.1%EPSS1article
CVE-2026-48567Microsoft Azure HorizonDB vulnerabilityCVSS10.0Critical–Not in KEV1.0%EPSS1article
CVE-2026-70242Microsoft 365 Apps for Enterprise vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS2articles
CVE-2026-103572Microsoft Visual Studio 2022 version 17.14 vulnerabilityCVSS8.8High–Not in KEV1.0%EPSS1article
CVE-2026-26118Azure MCP Server Tools Elevation of Privilege VulnerabilityCVSSUnrated–Not in KEV1.0%EPSS1article
CVE-2026-97016Microsoft 365 Apps for Enterprise vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS1article
CVE-2026-62878Microsoft Windows Server 2012 vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS4articles
CVE-2026-69525Microsoft Windows 10 Version 1607 vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS1article
CVE-2026-88156Microsoft 365 Apps for Enterprise vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS1article
CVE-2026-62893Microsoft Windows Server 2012 vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS2articles
CVE-2026-62815Microsoft Windows 11 version 23H2 vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS2articles
CVE-2026-69829Microsoft Windows 10 Version 1607 vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS1article
CVE-2026-69730Microsoft Windows 10 Version 1607 vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS3articles
CVE-2026-97749Microsoft 365 Apps for Enterprise vulnerabilityCVSS9.8Critical–Not in KEV1.0%EPSS1article
CVE-2026-63520Microsoft SharePoint Enterprise Server 2016 vulnerabilityCVSS8.1High–Not in KEV1.0%EPSS5articles
CVE-2026-23669RPC Runtime Library Remote Code Execution VulnerabilityCVSSUnrated–Not in KEV0.9%EPSS1article
CVE-2026-57092Microsoft Windows 10 Version 1607 vulnerabilityCVSS9.9Critical–Not in KEV0.9%EPSS1article
CVE-2026-33120Microsoft SQL Server 2022 (GDR) vulnerabilityCVSS8.8High–Not in KEV0.9%EPSS1article
CVE-2026-102870ASP.NET Core Remote Code Execution VulnerabilityCVSS8.8High–Not in KEV0.9%EPSS1article
CVE-2026-56162Microsoft Azure SQL Database vulnerabilityCVSS10.0Critical–Not in KEV0.9%EPSS1article
CVE-2026-65674Microsoft SQL Server 2019 (GDR) vulnerabilityCVSS8.8High–Not in KEV0.9%EPSS3articles
CVE-2026-65669Microsoft SQL Server Management Studio 22 vulnerabilityCVSS9.6Critical–Not in KEV0.9%EPSS1article
CVE-2026-42826Microsoft Azure DevOps vulnerabilityCVSS10.0Critical–Not in KEV0.8%EPSS1article
CVE-2026-33827Microsoft Windows 10 Version 1607 vulnerabilityCVSS8.1High–Not in KEV0.8%EPSS4articles
CVE-2026-63508Microsoft Planetary Computer Pro (GeoCatalog) vulnerabilityCVSS10.0Critical–Not in KEV0.8%EPSS1article
CVE-2026-69502Azure SQL Database Elevation of Privilege VulnerabilityCVSS10.0Critical–Not in KEV0.8%EPSS1article
CVE-2026-65667Microsoft Teams vulnerabilityCVSS10.0Critical–Not in KEV0.8%EPSS1article
CVE-2026-70197.NET and Visual Studio Remote Code Execution VulnerabilityCVSS8.1High–Not in KEV0.8%EPSS1article
CVE-2026-47301Microsoft Configuration Manager vulnerabilityCVSS8.8High–Not in KEV0.8%EPSS1article
CVE-2026-54121Microsoft Windows 10 Version 1607 vulnerabilityCVSS8.8High–Not in KEV0.8%EPSS2articles
CVE-2026-69465Microsoft SharePoint Server Subscription Edition vulnerabilityCVSS8.8High–Not in KEV0.8%EPSS2articles
CVE-2026-33109Microsoft Azure Managed Instance for Apache Cassandra vulnerabilityCVSS9.9Critical–Not in KEV0.7%EPSS2articles
CVE-2026-69524Microsoft Windows 10 Version 1607 vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS1article
CVE-2026-55007Microsoft Exchange Server 2019 Cumulative Update 14 vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS3articles
CVE-2026-65789Microsoft Windows Server 2016 vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS1article
CVE-2026-69510Microsoft Windows 10 Version 1607 vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS1article
CVE-2026-72981Microsoft Windows 10 Version 1607 vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS1article
CVE-2026-62911Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilityCVSS8.0High–Not in KEV0.7%EPSS3articles
CVE-2026-69380Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS2articles
CVE-2026-102866Microsoft SharePoint Server Subscription Edition vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS3articles
CVE-2026-50502Microsoft Windows 10 Version 1607 vulnerabilityCVSS8.0High–Not in KEV0.7%EPSS1article
CVE-2025-48804Microsoft Windows 10 Version 1507 vulnerabilityCVSS6.8Medium–Not in KEV0.7%EPSS1article
CVE-2026-40361Microsoft 365 Apps for Enterprise vulnerabilityCVSS8.4High–Not in KEV0.6%EPSS3articles
CVE-2026-42823Microsoft Azure Logic Apps vulnerabilityCVSS9.9Critical–Not in KEV0.6%EPSS1article
CVE-2026-26113Microsoft Office Remote Code Execution VulnerabilityCVSSUnrated–Not in KEV0.6%EPSS5articles
CVE-2026-26123Microsoft Authenticator Information Disclosure VulnerabilityCVSS5.5Medium–Not in KEV0.6%EPSS3articles
CVE-2026-62823Microsoft Windows Server 2012 vulnerabilityCVSS8.8High–Not in KEV0.5%EPSS1article
CVE-2026-33826Microsoft Windows Server 2012 R2 vulnerabilityCVSS8.0High–Not in KEV0.5%EPSS1article
CVE-2026-35421Microsoft Windows 10 Version 1607 vulnerabilityCVSS7.8High–Not in KEV0.5%EPSS1article
CVE-2026-24293Microsoft Windows 10 Version 21H2 vulnerabilityCVSS7.8High–Not in KEV0.5%EPSS1article
CVE-2026-26110Microsoft Office Remote Code Execution VulnerabilityCVSSUnrated–Not in KEV0.5%EPSS6articles
CVE-2026-50661Microsoft Windows 10 Version 1607 vulnerabilityCVSS6.1Medium–Not in KEV0.5%EPSS2articles
CVE-2026-108398Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 vulnerabilityCVSS8.8High–Not in KEV0.5%EPSS6articles
CVE-2026-45501Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilityCVSS6.5Medium–Not in KEV0.5%EPSS1article
CVE-2026-80097Microsoft Authenticator for Android vulnerabilityCVSS8.6High–Not in KEV0.4%EPSS2articles
CVE-2026-27912Microsoft Windows Server 2012 vulnerabilityCVSS8.0High–Not in KEV0.4%EPSS1article
CVE-2026-23665Linux Azure Diagnostic extension (LAD) Elevation of Privilege VulnerabilityCVSSUnrated–Not in KEV0.4%EPSS1article
CVE-2026-26128Microsoft Windows 10 Version 1607 vulnerabilityCVSS7.8High–Not in KEV0.4%EPSS1article
CVE-2026-62832Microsoft Windows 10 Version 21H2 vulnerabilityCVSS7.8High–Not in KEV0.4%EPSS6articles
CVE-2026-50454Microsoft Windows 11 Version 24H2 vulnerabilityCVSS7.8High–Not in KEV0.4%EPSS1article
CVE-2026-72971Microsoft Windows 11 version 26H1 vulnerabilityCVSS5.5Medium–Not in KEV0.4%EPSS5articles
CVE-2026-50656Microsoft Malware Protection Engine vulnerabilityCVSS7.8High–Not in KEV0.4%EPSS13articles
CVE-2026-40364Microsoft 365 Apps for Enterprise vulnerabilityCVSS8.4High–Not in KEV0.4%EPSS1article
CVE-2026-85921Microsoft Windows 11 version 26H1 vulnerabilityCVSS8.2High–Not in KEV0.3%EPSS1article
CVE-2026-83498Microsoft Windows 11 version 23H2 vulnerabilityCVSS7.8High–Not in KEV0.3%EPSS1article
CVE-2026-62735Microsoft Windows 10 Version 1607 vulnerabilityCVSS7.8High–Not in KEV0.3%EPSS1article
CVE-2026-32190Microsoft 365 Apps for Enterprise vulnerabilityCVSS8.4High–Not in KEV0.3%EPSS2articles
CVE-2026-49176Microsoft Windows 10 Version 1607 vulnerabilityCVSS7.8High–Not in KEV0.3%EPSS1article
CVE-2026-66804Microsoft Windows 10 Version 22H2 vulnerabilityCVSS7.8High–Not in KEV0.3%EPSS1article
CVE-2026-50343Microsoft Windows 10 Version 1809 vulnerabilityCVSS7.8High–Not in KEV0.3%EPSS1article
CVE-2026-62721Microsoft Windows 10 Version 1607 vulnerabilityCVSS7.8High–Not in KEV0.3%EPSS1article
CVE-2026-55945Microsoft Edge (Chromium-based) vulnerabilityCVSS4.2Medium–Not in KEV0.2%EPSS1article
How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device