Vendor dossier / #1
Microsoft vulnerabilities in CISA KEV
Answer CISA's KEV catalog lists 388 Microsoft vulnerabilities as of catalog 2026.09.23, 22.5% of all 1,721 entries and rank 1 of 283 vendors. The first was added on 2021-11-03 and the most recent on 2026-09-08; 117 are flagged as used in ransomware campaigns.
- KEV entries
- 38822.5% of catalog
- Last 90 days
- +11added
- Ransomware: known
- 11730.2%
- Products
- 72distinct
- First added
- 2021-11-03
- Latest added
- 2026-09-08
- Median days to due
- 21
- Open deadlines
- 0federal
TAdditions per quarter
Table view (by year)
| Year | Added |
|---|---|
| 2021 | 83 |
| 2022 | 165 |
| 2023 | 27 |
| 2024 | 36 |
| 2025 | 39 |
| 2026 | 38 |
QCommon questions
How many Microsoft vulnerabilities are in CISA KEV?
388, as of KEV catalog 2026.09.23 (released 2026-09-23). That is 22.5% of the catalog.
Which Microsoft product has the most KEV entries?
Windows, with 172 entries. 72 products appear in total.
How many Microsoft KEV vulnerabilities are linked to ransomware?
117 of 388 (30.2%) are flagged by CISA as known to be used in ransomware campaigns.
When was the latest Microsoft vulnerability added to KEV?
2026-09-08 (CVE-2026-85880).
What is the most common weakness in Microsoft KEV entries?
CWE-119 (Memory buffer bounds error), listed on 34 entries.
PProducts
| Product | Entries | Share of vendor |
|---|---|---|
| Windows | 172 | 44.3% |
| Internet Explorer | 36 | 9.3% |
| Office | 29 | 7.5% |
| Win32k | 25 | 6.4% |
| Exchange Server | 17 | 4.4% |
| SharePoint | 9 | 2.3% |
| SharePoint Server | 5 | 1.3% |
| Defender | 5 | 1.3% |
| Word | 4 | 1% |
| Open Management Infrastructure (OMI) | 4 | 1% |
| .NET Framework | 3 | 0.8% |
| Active Directory | 3 | 0.8% |
| Silverlight | 3 | 0.8% |
| Excel | 3 | 0.8% |
| SQL Server | 2 | 0.5% |
| Windows | 2 | 0.5% |
| XML Core Services | 2 | 0.5% |
| PowerPoint | 2 | 0.5% |
| SMBv1 server | 2 | 0.5% |
| DirectX Graphics Kernel (DXGKRNL) | 2 | 0.5% |
| Edge and Internet Explorer | 2 | 0.5% |
| Edge | 2 | 0.5% |
| Graphics Device Interface (GDI) | 2 | 0.5% |
| SMBv1 | 2 | 0.5% |
| MSHTML | 2 | 0.5% |
| Enhanced Cryptographic Provider | 2 | 0.5% |
| Internet Key Exchange (IKE) Service Extensions | 1 | 0.3% |
| Windows Ancillary Function Driver for WinSock | 1 | 0.3% |
| Active Directory Federation Services | 1 | 0.3% |
| DirectX | 1 | 0.3% |
| Microsoft | 1 | 0.3% |
| Visual Basic for Applications (VBA) | 1 | 0.3% |
| Configuration Manager | 1 | 0.3% |
| Partner Center | 1 | 0.3% |
| Power Pages | 1 | 0.3% |
| Office Outlook | 1 | 0.3% |
| Publisher | 1 | 0.3% |
| Project | 1 | 0.3% |
| DWM Core Library | 1 | 0.3% |
| SmartScreen Prompt | 1 | 0.3% |
| Streaming Service | 1 | 0.3% |
| Skype for Business | 1 | 0.3% |
| WordPad | 1 | 0.3% |
| Windows CNG Key Isolation Service | 1 | 0.3% |
| Streaming Service Proxy | 1 | 0.3% |
| .NET Core and Visual Studio | 1 | 0.3% |
| Outlook | 1 | 0.3% |
| Windows COM+ Event System Service | 1 | 0.3% |
| Input Method Editor (IME) Japanese | 1 | 0.3% |
| Internet Explorer and Edge | 1 | 0.3% |
| Update Notification Manager | 1 | 0.3% |
| HTTP Protocol Stack | 1 | 0.3% |
| Client-Server Run-time Subsystem (CSRSS) | 1 | 0.3% |
| Ancillary Function Driver (afd.sys) | 1 | 0.3% |
| Internet Explorer Scripting Engine | 1 | 0.3% |
| Kerberos Key Distribution Center (KDC) | 1 | 0.3% |
| Task Scheduler | 1 | 0.3% |
| Malware Protection Engine | 1 | 0.3% |
| ATM Font Driver | 1 | 0.3% |
| Forefront Threat Management Gateway (TMG) | 1 | 0.3% |
| Graphics Component | 1 | 0.3% |
| SMBv3 | 1 | 0.3% |
| HTTP.sys | 1 | 0.3% |
| WinVerifyTrust function | 1 | 0.3% |
| Exchange | 1 | 0.3% |
| Netlogon | 1 | 0.3% |
| .NET Framework, SharePoint, Visual Studio | 1 | 0.3% |
| Hyper-V RemoteFX | 1 | 0.3% |
| Remote Desktop Services | 1 | 0.3% |
| Internet Information Services (IIS) | 1 | 0.3% |
| Office and WordPad | 1 | 0.3% |
| MSCOMCTL.OCX | 1 | 0.3% |
WWeaknesses
| CWE | Entries | Share of vendor |
|---|---|---|
| CWE-119 Memory buffer bounds error | 34 | 8.8% |
| CWE-416 Use after free | 28 | 7.2% |
| CWE-20 Improper input validation | 28 | 7.2% |
| CWE-787 Out-of-bounds write | 26 | 6.7% |
| CWE-264 Permissions and access controls (category) | 20 | 5.2% |
| CWE-94 Code injection | 16 | 4.1% |
| CWE-59 Link following | 14 | 3.6% |
| CWE-502 Unsafe deserialization | 14 | 3.6% |
| CWE-122 Heap-based buffer overflow | 12 | 3.1% |
| CWE-269 Improper privilege management | 9 | 2.3% |
| CWE-693 Protection mechanism failure | 8 | 2.1% |
| CWE-200 Information exposure | 8 | 2.1% |
| No CWE listed | 66 | 17% |
EAll 388 entries
| CVE | Product | Vulnerability | Added | Due | Ransomware | CWE |
|---|---|---|---|---|---|---|
| CVE-2026-85880 | Windows | Microsoft Windows Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-122, CWE-908 | ||
| CVE-2026-81963 | Windows | Microsoft Windows Link Following Vulnerability | Unknown | CWE-59, CWE-284 | ||
| CVE-2019-1068 | SQL Server | Microsoft SQL Server Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2026-55040 | SharePoint | Microsoft SharePoint Weak Authentication Vulnerability | Unknown | CWE-1390 | ||
| CVE-2026-33824 | Internet Key Exchange (IKE) Service Extensions | Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability | Unknown | CWE-415 | ||
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2026-50522 | SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2026-58644 | SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2026-56164 | SharePoint Server | Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability | Unknown | CWE-306 | ||
| CVE-2026-56155 | Active Directory Federation Services | Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability | Unknown | CWE-1220 | ||
| CVE-2026-45659 | SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2026-45498 | Defender | Microsoft Defender Denial of Service Vulnerability | Unknown | none listed | ||
| CVE-2026-41091 | Defender | Microsoft Defender Link Following Vulnerability | Unknown | CWE-59 | ||
| CVE-2010-0806 | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | Unknown | CWE-399 | ||
| CVE-2010-0249 | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2009-1537 | DirectX | Microsoft DirectX NULL Byte Overwrite Vulnerability | Unknown | none listed | ||
| CVE-2008-4250 | Windows | Microsoft Windows Buffer Overflow Vulnerability | Unknown | CWE-94 | ||
| CVE-2026-42897 | Microsoft | Microsoft Exchange Server Cross-Site Scripting Vulnerability | Unknown | CWE-79 | ||
| CVE-2026-32202 | Windows | Microsoft Windows Protection Mechanism Failure Vulnerability | Unknown | CWE-693 | ||
| CVE-2026-33825 | Defender | Microsoft Defender Insufficient Granularity of Access Control Vulnerability | Known | CWE-1220 | ||
| CVE-2026-32201 | SharePoint Server | Microsoft SharePoint Server Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2009-0238 | Office | Microsoft Office Remote Code Execution | Unknown | CWE-94 | ||
| CVE-2025-60710 | Windows | Microsoft Windows Link Following Vulnerability | Known | CWE-59 | ||
| CVE-2023-36424 | Windows | Microsoft Windows Out-of-Bounds Read Vulnerability | Unknown | CWE-125 | ||
| CVE-2023-21529 | Exchange Server | Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2012-1854 | Visual Basic for Applications (VBA) | Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability | Unknown | CWE-426 | ||
| CVE-2026-20963 | SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2008-0015 | Windows | Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2024-43468 | Configuration Manager | Microsoft Configuration Manager SQL Injection Vulnerability | Unknown | CWE-89 | ||
| CVE-2026-21533 | Windows | Microsoft Windows Improper Privilege Management Vulnerability | Unknown | CWE-269 | ||
| CVE-2026-21525 | Windows | Microsoft Windows NULL Pointer Dereference Vulnerability | Unknown | CWE-476 | ||
| CVE-2026-21519 | Windows | Microsoft Windows Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2026-21514 | Office | Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability | Unknown | CWE-807 | ||
| CVE-2026-21513 | Windows | Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability | Unknown | CWE-693 | ||
| CVE-2026-21510 | Windows | Microsoft Windows Shell Protection Mechanism Failure Vulnerability | Unknown | CWE-693 | ||
| CVE-2026-21509 | Office | Microsoft Office Security Feature Bypass Vulnerability | Unknown | CWE-807 | ||
| CVE-2026-20805 | Windows | Microsoft Windows Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2009-0556 | Office | Microsoft Office PowerPoint Code Injection Vulnerability | Unknown | CWE-94 | ||
| CVE-2025-62221 | Windows | Microsoft Windows Use After Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2025-62215 | Windows | Microsoft Windows Race Condition Vulnerability | Unknown | CWE-362 | ||
| CVE-2025-59287 | Windows | Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2025-33073 | Windows | Microsoft Windows SMB Client Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2025-59230 | Windows | Microsoft Windows Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2025-24990 | Windows | Microsoft Windows Untrusted Pointer Dereference Vulnerability | Unknown | CWE-822 | ||
| CVE-2021-43226 | Windows | Microsoft Windows Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2013-3918 | Windows | Microsoft Windows Out-of-Bounds Write Vulnerability | Unknown | none listed | ||
| CVE-2011-3402 | Windows | Microsoft Windows Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2010-3962 | Internet Explorer | Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability | Unknown | none listed | ||
| CVE-2013-3893 | Internet Explorer | Microsoft Internet Explorer Resource Management Errors Vulnerability | Unknown | CWE-399 | ||
| CVE-2007-0671 | Office | Microsoft Office Excel Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2025-49706 | SharePoint | Microsoft SharePoint Improper Authentication Vulnerability | Known | CWE-287 | ||
| CVE-2025-49704 | SharePoint | Microsoft SharePoint Code Injection Vulnerability | Known | CWE-94 | ||
| CVE-2025-53770 | SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | Known | CWE-502 | ||
| CVE-2025-33053 | Windows | Microsoft Windows External Control of File Name or Path Vulnerability | Unknown | CWE-73 | ||
| CVE-2025-32709 | Windows | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2025-32706 | Windows | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2025-32701 | Windows | Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2025-30400 | Windows | Microsoft Windows DWM Core Library Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2025-30397 | Windows | Microsoft Windows Scripting Engine Type Confusion Vulnerability | Unknown | CWE-843 | ||
| CVE-2025-24054 | Windows | Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability | Unknown | CWE-73 | ||
| CVE-2025-29824 | Windows | Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability | Known | CWE-416 | ||
| CVE-2025-26633 | Windows | Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability | Known | CWE-707 | ||
| CVE-2025-24993 | Windows | Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2025-24991 | Windows | Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability | Unknown | CWE-125 | ||
| CVE-2025-24985 | Windows | Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability | Unknown | CWE-190, CWE-122 | ||
| CVE-2025-24984 | Windows | Microsoft Windows NTFS Information Disclosure Vulnerability | Unknown | CWE-532 | ||
| CVE-2025-24983 | Windows | Microsoft Windows Win32k Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2018-8639 | Windows | Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability | Known | CWE-404 | ||
| CVE-2024-49035 | Partner Center | Microsoft Partner Center Improper Access Control Vulnerability | Unknown | CWE-269 | ||
| CVE-2025-24989 | Power Pages | Microsoft Power Pages Improper Access Control Vulnerability | Unknown | CWE-284 | ||
| CVE-2025-21418 | Windows | Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2025-21391 | Windows | Microsoft Windows Storage Link Following Vulnerability | Unknown | CWE-59 | ||
| CVE-2024-21413 | Office Outlook | Microsoft Outlook Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2024-29059 | .NET Framework | Microsoft .NET Framework Information Disclosure Vulnerability | Unknown | CWE-209 | ||
| CVE-2025-21335 | Windows | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2025-21334 | Windows | Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2025-21333 | Windows | Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2024-35250 | Windows | Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability | Unknown | CWE-822 | ||
| CVE-2024-49138 | Windows | Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability | Unknown | CWE-122 | ||
| CVE-2024-49039 | Windows | Microsoft Windows Task Scheduler Privilege Escalation Vulnerability | Known | CWE-287 | ||
| CVE-2024-43451 | Windows | Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability | Unknown | CWE-73 | ||
| CVE-2024-38094 | SharePoint | Microsoft SharePoint Deserialization Vulnerability | Known | CWE-502 | ||
| CVE-2024-30088 | Windows | Microsoft Windows Kernel TOCTOU Race Condition Vulnerability | Known | CWE-367 | ||
| CVE-2024-43573 | Windows | Microsoft Windows MSHTML Platform Spoofing Vulnerability | Unknown | CWE-79 | ||
| CVE-2024-43572 | Windows | Microsoft Windows Management Console Remote Code Execution Vulnerability | Unknown | CWE-707 | ||
| CVE-2020-0618 | SQL Server | Microsoft SQL Server Reporting Services Remote Code Execution Vulnerability | Known | CWE-502 | ||
| CVE-2024-43461 | Windows | Microsoft Windows MSHTML Platform Spoofing Vulnerability | Unknown | CWE-451 | ||
| CVE-2024-38226 | Publisher | Microsoft Publisher Protection Mechanism Failure Vulnerability | Unknown | CWE-693 | ||
| CVE-2024-38217 | Windows | Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability | Unknown | CWE-693 | ||
| CVE-2024-38014 | Windows | Microsoft Windows Installer Improper Privilege Management Vulnerability | Unknown | CWE-269 | ||
| CVE-2021-31196 | Exchange Server | Microsoft Exchange Server Information Disclosure Vulnerability | Unknown | none listed | ||
| CVE-2024-38213 | Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | Unknown | CWE-693 | ||
| CVE-2024-38193 | Windows | Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2024-38189 | Project | Microsoft Project Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2024-38178 | Windows | Microsoft Windows Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-843 | ||
| CVE-2024-38107 | Windows | Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2024-38106 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-591 | ||
| CVE-2018-0824 | Windows | Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability | Unknown | CWE-502 | ||
| CVE-2012-4792 | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2024-38112 | Windows | Microsoft Windows MSHTML Platform Spoofing Vulnerability | Unknown | CWE-451 | ||
| CVE-2024-38080 | Windows | Microsoft Windows Hyper-V Privilege Escalation Vulnerability | Unknown | CWE-190 | ||
| CVE-2024-26169 | Windows | Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability | Known | CWE-269 | ||
| CVE-2024-30051 | DWM Core Library | Microsoft DWM Core Library Privilege Escalation Vulnerability | Known | CWE-122 | ||
| CVE-2024-30040 | Windows | Microsoft Windows MSHTML Platform Security Feature Bypass Vulnerability | Unknown | CWE-20 | ||
| CVE-2024-29988 | SmartScreen Prompt | Microsoft SmartScreen Prompt Security Feature Bypass Vulnerability | Unknown | CWE-693 | ||
| CVE-2022-38028 | Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2023-24955 | SharePoint Server | Microsoft SharePoint Server Code Injection Vulnerability | Known | CWE-94 | ||
| CVE-2024-21338 | Windows | Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability | Known | CWE-822 | ||
| CVE-2023-29360 | Streaming Service | Microsoft Streaming Service Untrusted Pointer Dereference Vulnerability | Unknown | CWE-822 | ||
| CVE-2024-21410 | Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | Unknown | CWE-287 | ||
| CVE-2024-21412 | Windows | Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability | Known | CWE-693 | ||
| CVE-2024-21351 | Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | Unknown | CWE-94 | ||
| CVE-2023-29357 | SharePoint Server | Microsoft SharePoint Server Privilege Escalation Vulnerability | Known | CWE-303 | ||
| CVE-2023-36584 | Windows | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | Unknown | none listed | ||
| CVE-2023-36036 | Windows | Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability | Unknown | CWE-122 | ||
| CVE-2023-36033 | Windows | Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | Unknown | CWE-822 | ||
| CVE-2023-36025 | Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | Unknown | none listed | ||
| CVE-2023-41763 | Skype for Business | Microsoft Skype for Business Privilege Escalation Vulnerability | Unknown | CWE-918 | ||
| CVE-2023-36563 | WordPad | Microsoft WordPad Information Disclosure Vulnerability | Unknown | CWE-20 | ||
| CVE-2023-28229 | Windows CNG Key Isolation Service | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | Unknown | CWE-591 | ||
| CVE-2023-36802 | Streaming Service Proxy | Microsoft Streaming Service Proxy Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-36761 | Word | Microsoft Word Information Disclosure Vulnerability | Unknown | CWE-668 | ||
| CVE-2023-38180 | .NET Core and Visual Studio | Microsoft .NET Core and Visual Studio Denial-of-Service Vulnerability | Unknown | none listed | ||
| CVE-2023-36884 | Windows | Microsoft Windows Search Remote Code Execution Vulnerability | Known | CWE-362 | ||
| CVE-2023-36874 | Windows | Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability | Unknown | CWE-59 | ||
| CVE-2023-35311 | Outlook | Microsoft Outlook Security Feature Bypass Vulnerability | Unknown | CWE-367 | ||
| CVE-2023-32049 | Windows | Microsoft Windows Defender SmartScreen Security Feature Bypass Vulnerability | Unknown | none listed | ||
| CVE-2023-32046 | Windows | Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2016-0165 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2023-29336 | Win32k | Microsoft Win32K Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2023-28252 | Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Known | CWE-122 | ||
| CVE-2019-1388 | Windows | Microsoft Windows Certificate Dialog Privilege Escalation Vulnerability | Known | CWE-269 | ||
| CVE-2013-3163 | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Unknown | CWE-94 | ||
| CVE-2023-24880 | Windows | Microsoft Windows SmartScreen Security Feature Bypass Vulnerability | Known | CWE-863 | ||
| CVE-2023-23397 | Office | Microsoft Office Outlook Privilege Escalation Vulnerability | Unknown | CWE-294 | ||
| CVE-2023-23376 | Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Known | CWE-122 | ||
| CVE-2023-21823 | Windows | Microsoft Windows Graphic Component Privilege Escalation Vulnerability | Unknown | CWE-190 | ||
| CVE-2023-21715 | Office | Microsoft Office Publisher Security Feature Bypass Vulnerability | Unknown | CWE-863 | ||
| CVE-2023-21674 | Windows | Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2022-41080 | Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2022-44698 | Defender | Microsoft Defender SmartScreen Security Feature Bypass Vulnerability | Known | CWE-755 | ||
| CVE-2022-41049 | Windows | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | Unknown | CWE-274 | ||
| CVE-2022-41128 | Windows | Microsoft Windows Scripting Languages Remote Code Execution Vulnerability | Unknown | CWE-787 | ||
| CVE-2022-41125 | Windows | Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability | Unknown | CWE-787 | ||
| CVE-2022-41091 | Windows | Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability | Known | CWE-863 | ||
| CVE-2022-41073 | Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | Known | CWE-787 | ||
| CVE-2022-41033 | Windows COM+ Event System Service | Microsoft Windows COM+ Event System Service Privilege Escalation Vulnerability | Unknown | CWE-843 | ||
| CVE-2022-41082 | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-502 | ||
| CVE-2022-41040 | Exchange Server | Microsoft Exchange Server Server-Side Request Forgery Vulnerability | Known | CWE-918 | ||
| CVE-2010-2568 | Windows | Microsoft Windows Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2022-37969 | Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Known | CWE-20, CWE-787 | ||
| CVE-2022-26923 | Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | Unknown | CWE-295 | ||
| CVE-2022-21971 | Windows | Microsoft Windows Runtime Remote Code Execution Vulnerability | Unknown | CWE-824 | ||
| CVE-2022-34713 | Windows | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2022-22047 | Windows | Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability | Unknown | CWE-426 | ||
| CVE-2022-26925 | Windows | Microsoft Windows LSA Spoofing Vulnerability | Unknown | CWE-306 | ||
| CVE-2022-30190 | Windows | Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability | Known | CWE-610 | ||
| CVE-2013-1331 | Office | Microsoft Office Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2012-4969 | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | Unknown | none listed | ||
| CVE-2012-1889 | XML Core Services | Microsoft XML Core Services Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2012-0151 | Windows | Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2010-2572 | PowerPoint | Microsoft PowerPoint Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2009-0563 | Office | Microsoft Office Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2009-0557 | Office | Microsoft Office Object Record Corruption Vulnerability | Unknown | CWE-94 | ||
| CVE-2006-2492 | Word | Microsoft Word Malformed Object Pointer Vulnerability | Unknown | CWE-120 | ||
| CVE-2016-7256 | Windows | Microsoft Windows Open Type Font Remote Code Execution Vulnerability | Unknown | CWE-284 | ||
| CVE-2016-3393 | Windows | Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability | Unknown | CWE-284 | ||
| CVE-2016-0034 | Silverlight | Microsoft Silverlight Runtime Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2015-6175 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2015-2425 | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2015-2360 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | CWE-119 | ||
| CVE-2015-1769 | Windows | Microsoft Windows Mount Manager Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2015-1671 | Windows | Microsoft Windows Remote Code Execution Vulnerability | Unknown | CWE-19 | ||
| CVE-2015-0071 | Internet Explorer | Microsoft Internet Explorer ASLR Bypass Vulnerability | Unknown | CWE-264 | ||
| CVE-2015-0016 | Windows | Microsoft Windows TS WebProxy Directory Traversal Vulnerability | Unknown | CWE-22 | ||
| CVE-2014-4148 | Windows | Microsoft Windows Remote Code Execution Vulnerability | Unknown | CWE-94 | ||
| CVE-2014-4123 | Internet Explorer | Microsoft Internet Explorer Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2014-4077 | Input Method Editor (IME) Japanese | Microsoft IME Japanese Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2014-2817 | Internet Explorer | Microsoft Internet Explorer Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2013-7331 | Internet Explorer | Microsoft Internet Explorer Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2013-3896 | Silverlight | Microsoft Silverlight Information Disclosure Vulnerability | Unknown | CWE-20 | ||
| CVE-2013-0074 | Silverlight | Microsoft Silverlight Double Dereference Vulnerability | Known | none listed | ||
| CVE-2018-8611 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-404 | ||
| CVE-2017-8543 | Windows | Microsoft Windows Search Remote Code Execution Vulnerability | Unknown | CWE-281 | ||
| CVE-2017-0210 | Internet Explorer | Microsoft Internet Explorer Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2017-0149 | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2017-0147 | SMBv1 server | Microsoft Windows SMBv1 Information Disclosure Vulnerability | Known | CWE-200 | ||
| CVE-2017-0022 | XML Core Services | Microsoft XML Core Services Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2017-0005 | Windows | Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation Vulnerability | Unknown | CWE-119 | ||
| CVE-2016-3351 | Internet Explorer and Edge | Microsoft Internet Explorer and Edge Information Disclosure Vulnerability | Known | CWE-200 | ||
| CVE-2016-3298 | Internet Explorer | Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2016-0162 | Internet Explorer | Microsoft Internet Explorer Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2020-1027 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-0638 | Update Notification Manager | Microsoft Update Notification Manager Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2019-1385 | Windows | Microsoft Windows AppX Deployment Extensions Privilege Escalation Vulnerability | Known | CWE-59 | ||
| CVE-2019-1130 | Windows | Microsoft Windows AppX Deployment Service Privilege Escalation Vulnerability | Known | CWE-59 | ||
| CVE-2019-0880 | Windows | Microsoft Windows Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-0703 | Windows | Microsoft Windows SMB Information Disclosure Vulnerability | Unknown | none listed | ||
| CVE-2019-0676 | Internet Explorer | Microsoft Internet Explorer Information Disclosure Vulnerability | Unknown | none listed | ||
| CVE-2018-8589 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2014-4113 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2014-0322 | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2022-26904 | Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | Unknown | CWE-362 | ||
| CVE-2022-21919 | Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | Unknown | CWE-1386 | ||
| CVE-2021-41357 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-40450 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2022-22718 | Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2022-24521 | Windows | Microsoft Windows CLFS Driver Privilege Escalation Vulnerability | Known | CWE-787, CWE-1285 | ||
| CVE-2015-2502 | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2021-42287 | Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | Known | CWE-269 | ||
| CVE-2021-42278 | Active Directory | Microsoft Active Directory Domain Services Privilege Escalation Vulnerability | Known | CWE-20 | ||
| CVE-2021-31166 | HTTP Protocol Stack | Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability | Unknown | CWE-416 | ||
| CVE-2017-0148 | SMBv1 server | Microsoft SMBv1 Server Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2021-34484 | Windows | Microsoft Windows User Profile Service Privilege Escalation Vulnerability | Unknown | CWE-269 | ||
| CVE-2021-38646 | Office | Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability | Known | none listed | ||
| CVE-2021-34486 | Windows | Microsoft Windows Event Tracing Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2018-8440 | Windows | Microsoft Windows Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2018-8406 | DirectX Graphics Kernel (DXGKRNL) | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability | Known | CWE-404 | ||
| CVE-2018-8405 | DirectX Graphics Kernel (DXGKRNL) | Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability | Known | CWE-404 | ||
| CVE-2017-0213 | Windows | Microsoft Windows Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2017-0059 | Internet Explorer | Microsoft Internet Explorer Information Disclosure Vulnerability | Unknown | CWE-200 | ||
| CVE-2017-0037 | Edge and Internet Explorer | Microsoft Edge and Internet Explorer Type Confusion Vulnerability | Unknown | CWE-704 | ||
| CVE-2016-7201 | Edge | Microsoft Edge Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2016-7200 | Edge | Microsoft Edge Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2016-0189 | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Known | CWE-119 | ||
| CVE-2016-0151 | Client-Server Run-time Subsystem (CSRSS) | Microsoft Windows CSRSS Security Feature Bypass Vulnerability | Known | CWE-264 | ||
| CVE-2016-0040 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2015-2426 | Windows | Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability | Unknown | CWE-119 | ||
| CVE-2015-2419 | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2015-1770 | Office | Microsoft Office Uninitialized Memory Use Vulnerability | Unknown | CWE-19 | ||
| CVE-2013-3660 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | CWE-119 | ||
| CVE-2013-2551 | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | Known | CWE-416 | ||
| CVE-2012-2539 | Word | Microsoft Word Remote Code Execution Vulnerability | Unknown | CWE-399 | ||
| CVE-2011-2005 | Ancillary Function Driver (afd.sys) | Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerability | Unknown | CWE-264 | ||
| CVE-2010-4398 | Windows | Microsoft Windows Kernel Stack-Based Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2022-21999 | Windows | Microsoft Windows Print Spooler Privilege Escalation Vulnerability | Known | CWE-40, CWE-1386 | ||
| CVE-2019-0903 | Graphics Device Interface (GDI) | Microsoft GDI Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2018-8414 | Windows | Microsoft Windows Shell Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2018-8373 | Internet Explorer Scripting Engine | Microsoft Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2017-0146 | Windows | Microsoft Windows SMB Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2014-6332 | Windows | Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability | Unknown | CWE-119 | ||
| CVE-2014-6324 | Kerberos Key Distribution Center (KDC) | Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2019-1405 | Windows | Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2019-1322 | Windows | Microsoft Windows Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2019-1315 | Windows | Microsoft Windows Error Reporting Manager Privilege Escalation Vulnerability | Known | CWE-59 | ||
| CVE-2019-1253 | Windows | Microsoft Windows AppX Deployment Server Privilege Escalation Vulnerability | Known | CWE-59 | ||
| CVE-2019-1132 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-1129 | Windows | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | Known | CWE-59 | ||
| CVE-2019-1069 | Task Scheduler | Microsoft Task Scheduler Privilege Escalation Vulnerability | Known | CWE-59 | ||
| CVE-2019-1064 | Windows | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | Known | CWE-59 | ||
| CVE-2019-0841 | Windows | Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability | Known | CWE-59 | ||
| CVE-2019-0543 | Windows | Microsoft Windows Privilege Escalation Vulnerability | Known | CWE-287 | ||
| CVE-2018-8120 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | CWE-404 | ||
| CVE-2017-0101 | Windows | Microsoft Windows Transaction Manager Privilege Escalation Vulnerability | Known | CWE-119 | ||
| CVE-2016-3309 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Known | CWE-264 | ||
| CVE-2015-2546 | Win32k | Microsoft Win32k Memory Corruption Vulnerability | Known | CWE-119 | ||
| CVE-2021-41379 | Windows | Microsoft Windows Installer Privilege Escalation Vulnerability | Known | CWE-1386 | ||
| CVE-2019-1297 | Excel | Microsoft Excel Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2018-8581 | Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2017-8540 | Malware Protection Engine | Microsoft Malware Protection Engine Improper Restriction of Operations Vulnerability | Unknown | CWE-119 | ||
| CVE-2017-11826 | Office | Microsoft Office Remote Code Execution Vulnerability | Unknown | CWE-119 | ||
| CVE-2017-0261 | Office | Microsoft Office Use-After-Free Vulnerability | Unknown | CWE-416 | ||
| CVE-2017-0001 | Graphics Device Interface (GDI) | Microsoft Graphics Device Interface (GDI) Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2016-7262 | Excel | Microsoft Office Security Feature Bypass Vulnerability | Unknown | CWE-20 | ||
| CVE-2016-7193 | Office | Microsoft Office Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2016-0099 | Windows | Microsoft Windows Secondary Logon Service Privilege Escalation Vulnerability | Known | CWE-264 | ||
| CVE-2015-2545 | Office | Microsoft Office Malformed EPS File Vulnerability | Unknown | CWE-20 | ||
| CVE-2015-2424 | PowerPoint | Microsoft PowerPoint Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2015-2387 | ATM Font Driver | Microsoft ATM Font Driver Privilege Escalation Vulnerability | Unknown | CWE-264 | ||
| CVE-2015-1701 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | CWE-264 | ||
| CVE-2015-1642 | Office | Microsoft Office Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2014-4114 | Windows | Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2013-5065 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-20 | ||
| CVE-2013-3897 | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability | Unknown | CWE-399 | ||
| CVE-2013-1347 | Internet Explorer | Microsoft Internet Explorer Remote Code Execution Vulnerability | Unknown | CWE-94 | ||
| CVE-2012-1856 | Office | Microsoft Office MSCOMCTL.OCX Remote Code Execution Vulnerability | Unknown | CWE-94 | ||
| CVE-2011-1889 | Forefront Threat Management Gateway (TMG) | Microsoft Forefront TMG Remote Code Execution Vulnerability | Unknown | CWE-119 | ||
| CVE-2010-3333 | Office | Microsoft Office Stack-based Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2010-0232 | Windows | Microsoft Windows Kernel Exception Handler Vulnerability | Unknown | CWE-264 | ||
| CVE-2009-3129 | Excel | Microsoft Excel Featheader Record Memory Corruption Vulnerability | Unknown | CWE-94 | ||
| CVE-2009-1123 | Windows | Microsoft Windows Improper Input Validation Vulnerability | Unknown | CWE-20 | ||
| CVE-2004-0210 | Windows | Microsoft Windows Privilege Escalation Vulnerability | Unknown | CWE-120 | ||
| CVE-2002-0367 | Windows | Microsoft Windows Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2017-8570 | Office | Microsoft Office Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2017-0222 | Internet Explorer | Microsoft Internet Explorer Remote Code Execution Vulnerability | Unknown | CWE-119 | ||
| CVE-2014-6352 | Windows | Microsoft Windows Code Injection Vulnerability | Unknown | CWE-94 | ||
| CVE-2019-0752 | Internet Explorer | Microsoft Internet Explorer Type Confusion Vulnerability | Known | CWE-843 | ||
| CVE-2018-8174 | Windows | Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability | Known | CWE-787 | ||
| CVE-2014-1761 | Word | Microsoft Word Memory Corruption Vulnerability | Unknown | CWE-119 | ||
| CVE-2013-3906 | Graphics Component | Microsoft Graphics Component Memory Corruption Vulnerability | Unknown | CWE-94 | ||
| CVE-2021-36934 | Windows | Microsoft Windows SAM Local Privilege Escalation Vulnerability | Unknown | CWE-1220 | ||
| CVE-2020-0796 | SMBv3 | Microsoft SMBv3 Remote Code Execution Vulnerability | Known | CWE-119 | ||
| CVE-2017-8464 | Windows | Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2017-0263 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | CWE-416 | ||
| CVE-2017-0262 | Office | Microsoft Office Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2017-0145 | SMBv1 | Microsoft SMBv1 Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2017-0144 | SMBv1 | Microsoft SMBv1 Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2015-1635 | HTTP.sys | Microsoft HTTP.sys Remote Code Execution Vulnerability | Unknown | CWE-94 | ||
| CVE-2022-21882 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | CWE-787 | ||
| CVE-2020-0787 | Windows | Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management Vulnerability | Known | CWE-269, CWE-59 | ||
| CVE-2014-1776 | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Unknown | CWE-416 | ||
| CVE-2018-8453 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | CWE-404 | ||
| CVE-2021-33766 | Exchange Server | Microsoft Exchange Server Information Disclosure | Unknown | CWE-287 | ||
| CVE-2019-1458 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2013-3900 | WinVerifyTrust function | Microsoft WinVerifyTrust function Remote Code Execution | Unknown | CWE-20 | ||
| CVE-2021-43890 | Windows | Microsoft Windows AppX Installer Spoofing Vulnerability | Known | none listed | ||
| CVE-2021-42321 | Exchange | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-184, CWE-502 | ||
| CVE-2021-42292 | Office | Microsoft Excel Security Feature Bypass | Unknown | CWE-357 | ||
| CVE-2021-40449 | Windows | Microsoft Windows Win32k Privilege Escalation Vulnerability | Known | CWE-416 | ||
| CVE-2021-40444 | MSHTML | Microsoft MSHTML Remote Code Execution Vulnerability | Known | CWE-22 | ||
| CVE-2021-38649 | Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-38648 | Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | Unknown | CWE-1390 | ||
| CVE-2021-38647 | Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Remote Code Execution Vulnerability | Known | CWE-1390 | ||
| CVE-2021-38645 | Open Management Infrastructure (OMI) | Microsoft Open Management Infrastructure (OMI) Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-36955 | Windows | Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2021-36948 | Windows | Microsoft Windows Update Medic Service Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-36942 | Windows | Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability | Known | CWE-749 | ||
| CVE-2021-34527 | Windows | Microsoft Windows Print Spooler Remote Code Execution Vulnerability | Known | CWE-269 | ||
| CVE-2021-34523 | Exchange Server | Microsoft Exchange Server Privilege Escalation Vulnerability | Known | CWE-287 | ||
| CVE-2021-34473 | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-918 | ||
| CVE-2021-34448 | Windows | Microsoft Windows Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-33771 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-119 | ||
| CVE-2021-33742 | Windows | Microsoft Windows MSHTML Platform Remote Code Execution Vulnerability | Unknown | CWE-787, CWE-823 | ||
| CVE-2021-33739 | Windows | Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-31979 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-119 | ||
| CVE-2021-31956 | Windows | Microsoft Windows NTFS Privilege Escalation Vulnerability | Unknown | CWE-191, CWE-787 | ||
| CVE-2021-31955 | Windows | Microsoft Windows Kernel Information Disclosure Vulnerability | Unknown | CWE-497 | ||
| CVE-2021-31207 | Exchange Server | Microsoft Exchange Server Security Feature Bypass Vulnerability | Known | CWE-20, CWE-434 | ||
| CVE-2021-31201 | Enhanced Cryptographic Provider | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-31199 | Enhanced Cryptographic Provider | Microsoft Enhanced Cryptographic Provider Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2021-28310 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | CWE-787 | ||
| CVE-2021-27085 | Internet Explorer | Microsoft Internet Explorer Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2021-27065 | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-39 | ||
| CVE-2021-27059 | Office | Microsoft Office Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2021-26858 | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | none listed | ||
| CVE-2021-26857 | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-502 | ||
| CVE-2021-26855 | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Known | CWE-918 | ||
| CVE-2021-26411 | Internet Explorer | Microsoft Internet Explorer Memory Corruption Vulnerability | Known | CWE-416 | ||
| CVE-2021-1732 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | CWE-787 | ||
| CVE-2021-1675 | Windows | Microsoft Windows Print Spooler Remote Code Execution Vulnerability | Known | CWE-285 | ||
| CVE-2021-1647 | Defender | Microsoft Defender Remote Code Execution Vulnerability | Unknown | CWE-122, CWE-1285 | ||
| CVE-2020-17144 | Exchange Server | Microsoft Exchange Server Remote Code Execution Vulnerability | Unknown | CWE-502 | ||
| CVE-2020-17087 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-131 | ||
| CVE-2020-1472 | Netlogon | Microsoft Netlogon Privilege Escalation Vulnerability | Known | CWE-330 | ||
| CVE-2020-1464 | Windows | Microsoft Windows Spoofing Vulnerability | Unknown | CWE-347 | ||
| CVE-2020-1380 | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-1350 | Windows | Microsoft Windows DNS Server Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2020-1147 | .NET Framework, SharePoint, Visual Studio | Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution Vulnerability | Unknown | none listed | ||
| CVE-2020-1054 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-1040 | Hyper-V RemoteFX | Microsoft Hyper-V RemoteFX vGPU Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2020-1020 | Windows | Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-0986 | Windows | Microsoft Windows Kernel Privilege Escalation Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-0968 | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Known | CWE-787 | ||
| CVE-2020-0938 | Windows | Microsoft Windows Adobe Font Manager Library Remote Code Execution Vulnerability | Unknown | CWE-787 | ||
| CVE-2020-0878 | Edge and Internet Explorer | Microsoft Edge and Internet Explorer Memory Corruption Vulnerability | Known | CWE-787 | ||
| CVE-2020-0688 | Exchange Server | Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability | Known | CWE-287 | ||
| CVE-2020-0683 | Windows | Microsoft Windows Installer Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2020-0674 | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-416 | ||
| CVE-2020-0646 | .NET Framework | Microsoft .NET Framework Remote Code Execution Vulnerability | Unknown | CWE-91 | ||
| CVE-2020-0601 | Windows | Microsoft Windows CryptoAPI Spoofing Vulnerability | Unknown | CWE-295 | ||
| CVE-2019-1429 | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-416, CWE-787 | ||
| CVE-2019-1367 | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Known | CWE-787 | ||
| CVE-2019-1215 | Windows | Microsoft Windows Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2019-1214 | Windows | Microsoft Windows Privilege Common Log File System (CLFS) Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-0863 | Windows | Microsoft Windows Error Reporting (WER) Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-0859 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2019-0808 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-0803 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | none listed | ||
| CVE-2019-0797 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Unknown | none listed | ||
| CVE-2019-0708 | Remote Desktop Services | Microsoft Remote Desktop Services Remote Code Execution Vulnerability | Known | CWE-416 | ||
| CVE-2019-0604 | SharePoint | Microsoft SharePoint Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2019-0541 | MSHTML | Microsoft MSHTML Remote Code Execution Vulnerability | Unknown | CWE-77 | ||
| CVE-2018-8653 | Internet Explorer | Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2018-0802 | Office | Microsoft Office Memory Corruption Vulnerability | Known | CWE-787 | ||
| CVE-2018-0798 | Office | Microsoft Office Memory Corruption Vulnerability | Unknown | CWE-787 | ||
| CVE-2017-8759 | .NET Framework | Microsoft .NET Framework Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2017-7269 | Internet Information Services (IIS) | Microsoft Windows Server Buffer Overflow Vulnerability | Unknown | CWE-119 | ||
| CVE-2017-11882 | Office | Microsoft Office Memory Corruption Vulnerability | Known | CWE-119 | ||
| CVE-2017-11774 | Office | Microsoft Office Outlook Security Feature Bypass Vulnerability | Unknown | CWE-119 | ||
| CVE-2017-0199 | Office and WordPad | Microsoft Office and WordPad Remote Code Execution Vulnerability | Known | none listed | ||
| CVE-2017-0143 | Windows | Microsoft Windows Server Message Block (SMBv1) Remote Code Execution Vulnerability | Known | CWE-20 | ||
| CVE-2016-7255 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | CWE-264 | ||
| CVE-2016-3235 | Office | Microsoft Office OLE DLL Side Loading Vulnerability | Unknown | CWE-264 | ||
| CVE-2016-0185 | Windows | Microsoft Windows Media Center Remote Code Execution Vulnerability | Unknown | CWE-20 | ||
| CVE-2016-0167 | Win32k | Microsoft Win32k Privilege Escalation Vulnerability | Known | CWE-264 | ||
| CVE-2015-1641 | Office | Microsoft Office Memory Corruption Vulnerability | Unknown | CWE-399 | ||
| CVE-2014-1812 | Windows | Microsoft Windows Group Policy Preferences Password Privilege Escalation Vulnerability | Known | CWE-255 | ||
| CVE-2012-0158 | MSCOMCTL.OCX | Microsoft MSCOMCTL.OCX Remote Code Execution Vulnerability | Known | CWE-94 |
Cite this
CISA's Known Exploited Vulnerabilities catalog lists 388 Microsoft vulnerabilities (22.5% of all entries). Source: Telemetry analysis of the CISA Known Exploited Vulnerabilities catalog, version 2026.09.23 (released 2026-09-23). https://glide-telemetry.pages.dev/vendors/microsoft/
Source: CISA KEV catalog v2026.09.23, released 2026-09-23. Windows end 2026-09-23. Vendor names are CISA's vendorProject strings; Telemetry states no facts about Microsoft beyond this data.