Cyberfeed6 › Vendors › Microsoft
CISA lists 390 Microsoft vulnerabilities as exploited in real attacks, and 117 of them are known to be used in ransomware campaigns. Most entries concern Windows, Internet Explorer, Office, Win32k.
Showing the 40 most recently added of 390. Check the vendor notice before you act: it names the fixed versions.
| Vulnerability | Product | Added to list | Severity | Ransomware | Fix |
|---|---|---|---|---|---|
| CVE-2026-96951Microsoft Windows Command Injection Vulnerability | Windows | 2026-10-13 | High (8.8) | No | Vendor notice |
| CVE-2026-65660Microsoft SharePoint Code Injection Vulnerability | SharePoint | 2026-09-25 | High (8.8) | No | Vendor notice |
| CVE-2026-85880Microsoft Windows Heap-Based Buffer Overflow Vulnerability | Windows | 2026-09-08 | High (7.8) | No | Vendor notice |
| CVE-2026-81963Microsoft Windows Link Following Vulnerability | Windows | 2026-09-08 | High (7.8) | No | Vendor notice |
| CVE-2019-1068Microsoft SQL Server Remote Code Execution Vulnerability | SQL Server | 2026-08-26 | High (8.8) | No | Vendor notice |
| CVE-2026-55040Microsoft SharePoint Weak Authentication Vulnerability | SharePoint | 2026-08-18 | Critical (9.1) | No | Vendor notice |
| CVE-2026-33824Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability | Internet Key Exchange (IKE) Service Extensions | 2026-08-18 | Critical (9.8) | No | Vendor notice |
| CVE-2026-68820Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | Windows Ancillary Function Driver for WinSock | 2026-08-11 | High (7.0) | No | Vendor notice |
| CVE-2026-50522Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | SharePoint | 2026-07-22 | Critical (9.8) | No | Vendor notice |
| CVE-2026-58644Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | SharePoint | 2026-07-16 | Critical (9.8) | No | Vendor notice |
| CVE-2026-56164Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability | SharePoint Server | 2026-07-14 | Medium (5.3) | No | Vendor notice |
| CVE-2026-56155Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability | Active Directory Federation Services | 2026-07-14 | High (7.8) | No | Vendor notice |
| CVE-2026-45659Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability | SharePoint Server | 2026-07-01 | High (8.8) | Yes | Vendor notice |
| CVE-2026-45498Microsoft Defender Denial of Service Vulnerability | Defender | 2026-05-20 | Medium (4.0) | No | Vendor notice |
| CVE-2026-41091Microsoft Defender Link Following Vulnerability | Defender | 2026-05-20 | High (7.8) | No | Vendor notice |
| CVE-2010-0806Microsoft Internet Explorer Use-After-Free Vulnerability | Internet Explorer | 2026-05-20 | High (8.8) | No | Vendor notice |
| CVE-2010-0249Microsoft Internet Explorer Use-After-Free Vulnerability | Internet Explorer | 2026-05-20 | High (8.8) | No | Vendor notice |
| CVE-2009-1537Microsoft DirectX NULL Byte Overwrite Vulnerability | DirectX | 2026-05-20 | High (8.8) | No | Vendor notice |
| CVE-2008-4250Microsoft Windows Buffer Overflow Vulnerability | Windows | 2026-05-20 | Critical (9.8) | No | Vendor notice |
| CVE-2026-42897Microsoft Exchange Server Cross-Site Scripting Vulnerability | Microsoft | 2026-05-15 | High (8.1) | No | Vendor notice |
| CVE-2026-32202Microsoft Windows Protection Mechanism Failure Vulnerability | Windows | 2026-04-28 | Medium (4.3) | No | Vendor notice |
| CVE-2026-33825Microsoft Defender Insufficient Granularity of Access Control Vulnerability | Defender | 2026-04-22 | High (7.8) | Yes | Vendor notice |
| CVE-2026-32201Microsoft SharePoint Server Improper Input Validation Vulnerability | SharePoint Server | 2026-04-14 | Medium (6.5) | No | Vendor notice |
| CVE-2009-0238Microsoft Office Remote Code Execution | Office | 2026-04-14 | High (8.8) | No | Vendor notice |
| CVE-2025-60710Microsoft Windows Link Following Vulnerability | Windows | 2026-04-13 | High (7.8) | Yes | Vendor notice |
| CVE-2023-36424Microsoft Windows Out-of-Bounds Read Vulnerability | Windows | 2026-04-13 | High (7.8) | No | Vendor notice |
| CVE-2023-21529Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability | Exchange Server | 2026-04-13 | High (8.8) | Yes | Vendor notice |
| CVE-2012-1854Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability | Visual Basic for Applications (VBA) | 2026-04-13 | High (7.8) | No | Vendor notice |
| CVE-2026-20963Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | SharePoint | 2026-03-18 | Critical (9.8) | No | Vendor notice |
| CVE-2008-0015Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability | Windows | 2026-02-17 | High (8.8) | No | Vendor notice |
| CVE-2024-43468Microsoft Configuration Manager SQL Injection Vulnerability | Configuration Manager | 2026-02-12 | Critical (9.8) | No | Vendor notice |
| CVE-2026-21533Microsoft Windows Improper Privilege Management Vulnerability | Windows | 2026-02-10 | High (7.8) | No | Vendor notice |
| CVE-2026-21525Microsoft Windows NULL Pointer Dereference Vulnerability | Windows | 2026-02-10 | Medium (6.2) | No | Vendor notice |
| CVE-2026-21519Microsoft Windows Type Confusion Vulnerability | Windows | 2026-02-10 | High (7.8) | No | Vendor notice |
| CVE-2026-21514Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability | Office | 2026-02-10 | High (7.8) | No | Vendor notice |
| CVE-2026-21513Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability | Windows | 2026-02-10 | High (8.8) | No | Vendor notice |
| CVE-2026-21510Microsoft Windows Shell Protection Mechanism Failure Vulnerability | Windows | 2026-02-10 | High (8.8) | No | Vendor notice |
| CVE-2026-21509Microsoft Office Security Feature Bypass Vulnerability | Office | 2026-01-26 | High (7.8) | No | Vendor notice |
| CVE-2026-20805Microsoft Windows Information Disclosure Vulnerability | Windows | 2026-01-13 | Medium (5.5) | No | Vendor notice |
| CVE-2009-0556Microsoft Office PowerPoint Code Injection Vulnerability | Office | 2026-01-07 | High (8.8) | No | Vendor notice |
OT November 1, 2026
IT October 27, 2026
IT October 16, 2026
Microsoft's October Patch Tuesday sets a record at about 1,400 fixes
IT October 13, 2026
Network edge devices and AI tooling keep appearing on CISA's exploited list
IT September, 2026
Security tools turned into credential stealers in a supply-chain campaign
IT August, 2026
SharePoint Server flaws exploited as zero-days and within days of patching
IT July 14, 2026
Source: CISA Known Exploited Vulnerabilities catalog, released 2026-11-04. Severity scores are CVSS where available. "Ransomware" means CISA has marked the flaw as known to be used in ransomware campaigns.