Microsoft flaws being used in attacks
CISA lists 390 flaws in Microsoft products as being used in attacks, most recently on 13 Oct 2026. 117 have been used in ransomware.
MicrosoftBeing used in attacks
- On CISA’s list
- 390 flaws, added between 3 Nov 2021 and 13 Oct 2026
- Most recent
- CVE-2026-96951, Microsoft Windows Command Injection Vulnerability, added 13 Oct 2026
- Used in ransomware
- 117 flaws, according to CISA
- Products
- Windows (175), Internet Explorer (36), Office (29), Win32k (25), Exchange Server (17), and 66 more
What to do
- Update every Microsoft product you use.Install the updates Microsoft offers, on every device, and restart when asked. Each flaw below has a fix or clear advice; that’s one of CISA’s conditions for listing it.
- If someone looks after IT for you, send them this page.Many of these are in equipment you don’t see: routers, firewalls, servers, the office network. Ask them to confirm each one is fixed, or that you don’t use the product.
- Check anything else in the lookup.Search any app, company or CVE. Not being on CISA’s list doesn’t mean safe: keep updating either way.
Every flaw, newest first
- Microsoft Windows
CVE-2026-96951Microsoft Windows Command Injection VulnerabilityMicrosoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft SharePoint
CVE-2026-65660Microsoft SharePoint Code Injection VulnerabilityMicrosoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft Windows
CVE-2026-85880Microsoft Windows Heap-Based Buffer Overflow VulnerabilityMicrosoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft Windows
CVE-2026-81963Microsoft Windows Link Following VulnerabilityMicrosoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft SQL Server
CVE-2019-1068Microsoft SQL Server Remote Code Execution VulnerabilityMicrosoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft SharePoint
CVE-2026-55040Microsoft SharePoint Weak Authentication VulnerabilityMicrosoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft Internet Key Exchange (IKE) Service Extensions
CVE-2026-33824Microsoft Internet Key Exchange (IKE) Service Extensions Double Free VulnerabilityMicrosoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft Windows Ancillary Function Driver for WinSock
CVE-2026-68820Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityMicrosoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft SharePoint
CVE-2026-50522Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityMicrosoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft SharePoint
CVE-2026-58644Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityMicrosoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft SharePoint Server
CVE-2026-56164Microsoft SharePoint Server Missing Authentication for Critical Function VulnerabilityMicrosoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft Active Directory Federation Services
CVE-2026-56155Microsoft Active Directory Federation Services Insufficient Granularity of Access Control VulnerabilityMicrosoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft SharePoint Server
CVE-2026-45659Microsoft SharePoint Server Deserialization of Untrusted Data VulnerabilityMicrosoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.CISA’s required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Read all
Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines. - Microsoft Defender
CVE-2026-45498Microsoft Defender Denial of Service VulnerabilityMicrosoft Defender contains an unspecified vulnerability that allows for denial of service.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Defender
CVE-2026-41091Microsoft Defender Link Following VulnerabilityMicrosoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Internet Explorer
CVE-2010-0806Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Internet Explorer
CVE-2010-0249Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft DirectX
CVE-2009-1537Microsoft DirectX NULL Byte Overwrite VulnerabilityMicrosoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2008-4250Microsoft Windows Buffer Overflow VulnerabilityMicrosoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft
CVE-2026-42897Microsoft Exchange Server Cross-Site Scripting VulnerabilityMicrosoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2026-32202Microsoft Windows Protection Mechanism Failure VulnerabilityMicrosoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Defender
CVE-2026-33825Microsoft Defender Insufficient Granularity of Access Control VulnerabilityMicrosoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft SharePoint Server
CVE-2026-32201Microsoft SharePoint Server Improper Input Validation VulnerabilityMicrosoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Office
CVE-2009-0238Microsoft Office Remote Code ExecutionMicrosoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-60710Microsoft Windows Link Following VulnerabilityMicrosoft Windows contains a link following vulnerability that allows for privilege escalationCISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2023-36424Microsoft Windows Out-of-Bounds Read VulnerabilityMicrosoft Windows Common Log File System Driver contains an out-of-bounds read vulnerability that could allow a threat actor for privileges escalationCISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Exchange Server
CVE-2023-21529Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityMicrosoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Visual Basic for Applications (VBA)
CVE-2012-1854Microsoft Visual Basic for Applications Insecure Library Loading VulnerabilityMicrosoft Visual Basic for Applications (VBA) contains an insecure library loading vulnerability that could allow for remote code execution.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft SharePoint
CVE-2026-20963Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityMicrosoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2008-0015Microsoft Windows Video ActiveX Control Remote Code Execution VulnerabilityMicrosoft Windows Video ActiveX Control contains a remote code execution vulnerability. An attacker could exploit the vulnerability by constructing a specially crafted Web page. When a user views the Web page, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the logged-on user.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Configuration Manager
CVE-2024-43468Microsoft Configuration Manager SQL Injection VulnerabilityMicrosoft Configuration Manager contains an SQL injection vulnerability. An unauthenticated attacker could exploit this vulnerability by sending specially crafted requests to the target environment which are processed in an unsafe manner enabling the attacker to execute commands on the server and/or underlying database.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2026-21533Microsoft Windows Improper Privilege Management VulnerabilityMicrosoft Windows Remote Desktop Services contains an improper privilege management vulnerability that could allow an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2026-21525Microsoft Windows NULL Pointer Dereference VulnerabilityMicrosoft Windows Remote Access Connection Manager contains a NULL pointer dereference that could allow an unauthorized attacker to deny service locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2026-21519Microsoft Windows Type Confusion VulnerabilityMicrosoft Desktop Windows Manager contains a type confusion vulnerability that could allow an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Office
CVE-2026-21514Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision VulnerabilityMicrosoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2026-21513Microsoft MSHTML Framework Protection Mechanism Failure VulnerabilityMicrosoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2026-21510Microsoft Windows Shell Protection Mechanism Failure VulnerabilityMicrosoft Windows Shell contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Office
CVE-2026-21509Microsoft Office Security Feature Bypass VulnerabilityMicrosoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2026-20805Microsoft Windows Information Disclosure VulnerabilityMicrosoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Office
CVE-2009-0556Microsoft Office PowerPoint Code Injection VulnerabilityMicrosoft Office PowerPoint contains a code injection vulnerability that allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an invalid index value that triggers memory corruption.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-62221Microsoft Windows Use After Free VulnerabilityMicrosoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-62215Microsoft Windows Race Condition VulnerabilityMicrosoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-59287Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data VulnerabilityMicrosoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-33073Microsoft Windows SMB Client Improper Access Control VulnerabilityMicrosoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-59230Microsoft Windows Improper Access Control VulnerabilityMicrosoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-24990Microsoft Windows Untrusted Pointer Dereference VulnerabilityMicrosoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2021-43226Microsoft Windows Privilege Escalation VulnerabilityMicrosoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2013-3918Microsoft Windows Out-of-Bounds Write VulnerabilityMicrosoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2011-3402Microsoft Windows Remote Code Execution VulnerabilityMicrosoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Internet Explorer
CVE-2010-3962Microsoft Internet Explorer Uninitialized Memory Corruption VulnerabilityMicrosoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Internet Explorer
CVE-2013-3893Microsoft Internet Explorer Resource Management Errors VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Office
CVE-2007-0671Microsoft Office Excel Remote Code Execution VulnerabilityMicrosoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft SharePoint
CVE-2025-49706Microsoft SharePoint Improper Authentication VulnerabilityMicrosoft SharePoint contains an improper authentication vulnerability that allows an authorized attacker to perform spoofing over a network. Successfully exploitation could allow an attacker to view sensitive information and make some changes to disclosed information. This vulnerability could be chained with CVE-2025-49704. CVE-2025-53771 is a patch bypass for CVE-2025-49706, and the updates for CVE-2025-53771 include more robust protection than those for CVE-2025-49706.CISA’s required actionDisconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. Read all
For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. - Microsoft SharePoint
CVE-2025-49704Microsoft SharePoint Code Injection VulnerabilityMicrosoft SharePoint contains a code injection vulnerability that could allow an authorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-49706. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.CISA’s required actionDisconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. Read all
For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. - Microsoft SharePoint
CVE-2025-53770Microsoft SharePoint Deserialization of Untrusted Data VulnerabilityMicrosoft SharePoint Server on-premises contains a deserialization of untrusted data vulnerability that could allow an unauthorized attacker to execute code over a network. This vulnerability could be chained with CVE-2025-53771. CVE-2025-53770 is a patch bypass for CVE-2025-49704, and the updates for CVE-2025-53770 include more robust protection than those for CVE-2025-49704.CISA’s required actionDisconnect public-facing versions of SharePoint Server that have reached their end-of-life (EOL) or end-of-service (EOS) to include SharePoint Server 2013 and earlier versions. Read all
For supported versions, please follow the mitigations according to CISA (URL listed below in Notes) and vendor instructions (URL listed below in Notes). Adhere to the applicable BOD 22-01 guidance for cloud services or discontinue use of the product if mitigations are not available. - Microsoft Windows
CVE-2025-33053Microsoft Windows External Control of File Name or Path VulnerabilityMicrosoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-32709Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free VulnerabilityMicrosoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-32706Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityMicrosoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-32701Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityMicrosoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-30400Microsoft Windows DWM Core Library Use-After-Free VulnerabilityMicrosoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-30397Microsoft Windows Scripting Engine Type Confusion VulnerabilityMicrosoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-24054Microsoft Windows NTLM Hash Disclosure Spoofing VulnerabilityMicrosoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-29824Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free VulnerabilityMicrosoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-26633Microsoft Windows Management Console (MMC) Improper Neutralization VulnerabilityMicrosoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-24993Microsoft Windows NTFS Heap-Based Buffer Overflow VulnerabilityMicrosoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-24991Microsoft Windows NTFS Out-Of-Bounds Read VulnerabilityMicrosoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-24985Microsoft Windows Fast FAT File System Driver Integer Overflow VulnerabilityMicrosoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-24984Microsoft Windows NTFS Information Disclosure VulnerabilityMicrosoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-24983Microsoft Windows Win32k Use-After-Free VulnerabilityMicrosoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2018-8639Microsoft Windows Win32k Improper Resource Shutdown or Release VulnerabilityMicrosoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Partner Center
CVE-2024-49035Microsoft Partner Center Improper Access Control VulnerabilityMicrosoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges.CISA’s required actionApply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Power Pages
CVE-2025-24989Microsoft Power Pages Improper Access Control VulnerabilityMicrosoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control.CISA’s required actionApply mitigations per vendor instructions, follow BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-21418Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow VulnerabilityMicrosoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-21391Microsoft Windows Storage Link Following VulnerabilityMicrosoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Office Outlook
CVE-2024-21413Microsoft Outlook Improper Input Validation VulnerabilityMicrosoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft .NET Framework
CVE-2024-29059Microsoft .NET Framework Information Disclosure VulnerabilityMicrosoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-21335Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityMicrosoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-21334Microsoft Windows Hyper-V NT Kernel Integration VSP Use-After-Free VulnerabilityMicrosoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2025-21333Microsoft Windows Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow VulnerabilityMicrosoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-35250Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference VulnerabilityMicrosoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-49138Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow VulnerabilityMicrosoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-49039Microsoft Windows Task Scheduler Privilege Escalation VulnerabilityMicrosoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-43451Microsoft Windows NTLMv2 Hash Disclosure Spoofing VulnerabilityMicrosoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft SharePoint
CVE-2024-38094Microsoft SharePoint Deserialization VulnerabilityMicrosoft SharePoint contains a deserialization vulnerability that allows for remote code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-30088Microsoft Windows Kernel TOCTOU Race Condition VulnerabilityMicrosoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-43573Microsoft Windows MSHTML Platform Spoofing VulnerabilityMicrosoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-43572Microsoft Windows Management Console Remote Code Execution VulnerabilityMicrosoft Windows Management Console contains unspecified vulnerability that allows for remote code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft SQL Server
CVE-2020-0618Microsoft SQL Server Reporting Services Remote Code Execution VulnerabilityMicrosoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-43461Microsoft Windows MSHTML Platform Spoofing VulnerabilityMicrosoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Publisher
CVE-2024-38226Microsoft Publisher Protection Mechanism Failure VulnerabilityMicrosoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-38217Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure VulnerabilityMicrosoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-38014Microsoft Windows Installer Improper Privilege Management VulnerabilityMicrosoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Exchange Server
CVE-2021-31196Microsoft Exchange Server Information Disclosure VulnerabilityMicrosoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-38213Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-38193Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation VulnerabilityMicrosoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Project
CVE-2024-38189Microsoft Project Remote Code Execution VulnerabilityMicrosoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-38178Microsoft Windows Scripting Engine Memory Corruption VulnerabilityMicrosoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-38107Microsoft Windows Power Dependency Coordinator Privilege Escalation VulnerabilityMicrosoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-38106Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2018-0824Microsoft COM for Windows Deserialization of Untrusted Data VulnerabilityMicrosoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Internet Explorer
CVE-2012-4792Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Microsoft Windows
CVE-2024-38112Microsoft Windows MSHTML Platform Spoofing VulnerabilityMicrosoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-38080Microsoft Windows Hyper-V Privilege Escalation VulnerabilityMicrosoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-26169Microsoft Windows Error Reporting Service Improper Privilege Management VulnerabilityMicrosoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable. - Microsoft DWM Core Library
CVE-2024-30051Microsoft DWM Core Library Privilege Escalation VulnerabilityMicrosoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-30040Microsoft Windows MSHTML Platform Security Feature Bypass VulnerabilityMicrosoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft SmartScreen Prompt
CVE-2024-29988Microsoft SmartScreen Prompt Security Feature Bypass VulnerabilityMicrosoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2022-38028Microsoft Windows Print Spooler Privilege Escalation VulnerabilityMicrosoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft SharePoint Server
CVE-2023-24955Microsoft SharePoint Server Code Injection VulnerabilityMicrosoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-21338Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control VulnerabilityMicrosoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Streaming Service
CVE-2023-29360Microsoft Streaming Service Untrusted Pointer Dereference VulnerabilityMicrosoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Exchange Server
CVE-2024-21410Microsoft Exchange Server Privilege Escalation VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-21412Microsoft Windows Internet Shortcut Files Security Feature Bypass VulnerabilityMicrosoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2024-21351Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft SharePoint Server
CVE-2023-29357Microsoft SharePoint Server Privilege Escalation VulnerabilityMicrosoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2023-36584Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityMicrosoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2023-36036Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation VulnerabilityMicrosoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2023-36033Microsoft Windows Desktop Window Manager (DWM) Core Library Privilege Escalation VulnerabilityMicrosoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2023-36025Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Skype for Business
CVE-2023-41763Microsoft Skype for Business Privilege Escalation VulnerabilityMicrosoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft WordPad
CVE-2023-36563Microsoft WordPad Information Disclosure VulnerabilityMicrosoft WordPad contains an unspecified vulnerability that allows for information disclosure.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows CNG Key Isolation Service
CVE-2023-28229Microsoft Windows CNG Key Isolation Service Privilege Escalation VulnerabilityMicrosoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Streaming Service Proxy
CVE-2023-36802Microsoft Streaming Service Proxy Privilege Escalation VulnerabilityMicrosoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Word
CVE-2023-36761Microsoft Word Information Disclosure VulnerabilityMicrosoft Word contains an unspecified vulnerability that allows for information disclosure.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft .NET Core and Visual Studio
CVE-2023-38180Microsoft .NET Core and Visual Studio Denial-of-Service VulnerabilityMicrosoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS).CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2023-36884Microsoft Windows Search Remote Code Execution VulnerabilityMicrosoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution.CISA’s required actionApply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. - Microsoft Windows
CVE-2023-36874Microsoft Windows Error Reporting Service Privilege Escalation VulnerabilityMicrosoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable. - Microsoft Outlook
CVE-2023-35311Microsoft Outlook Security Feature Bypass VulnerabilityMicrosoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable. - Microsoft Windows
CVE-2023-32049Microsoft Windows Defender SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable. - Microsoft Windows
CVE-2023-32046Microsoft Windows MSHTML Platform Privilege Escalation VulnerabilityMicrosoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions or discontinue use of the product if updates are unavailable. - Microsoft Win32k
CVE-2016-0165Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2023-29336Microsoft Win32K Privilege Escalation VulnerabilityMicrosoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2023-28252Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityMicrosoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1388Microsoft Windows Certificate Dialog Privilege Escalation VulnerabilityMicrosoft Windows Certificate Dialog contains a privilege escalation vulnerability, allowing attackers to run processes in an elevated context.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2013-3163Microsoft Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial of service via a crafted website.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Microsoft Windows
CVE-2023-24880Microsoft Windows SmartScreen Security Feature Bypass VulnerabilityMicrosoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2023-23397Microsoft Office Outlook Privilege Escalation VulnerabilityMicrosoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2023-23376Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityMicrosoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2023-21823Microsoft Windows Graphic Component Privilege Escalation VulnerabilityMicrosoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2023-21715Microsoft Office Publisher Security Feature Bypass VulnerabilityMicrosoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2023-21674Microsoft Windows Advanced Local Procedure Call (ALPC) Privilege Escalation VulnerabilityMicrosoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2022-41080Microsoft Exchange Server Privilege Escalation VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Defender
CVE-2022-44698Microsoft Defender SmartScreen Security Feature Bypass VulnerabilityMicrosoft Defender SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-41049Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityMicrosoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-41128Microsoft Windows Scripting Languages Remote Code Execution VulnerabilityMicrosoft Windows contains an unspecified vulnerability in the JScript9 scripting language which allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-41125Microsoft Windows CNG Key Isolation Service Privilege Escalation VulnerabilityMicrosoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-41091Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass VulnerabilityMicrosoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-41073Microsoft Windows Print Spooler Privilege Escalation VulnerabilityMicrosoft Windows Print Spooler contains an unspecified vulnerability that allows an attacker to gain SYSTEM-level privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows COM+ Event System Service
CVE-2022-41033Microsoft Windows COM+ Event System Service Privilege Escalation VulnerabilityMicrosoft Windows COM+ Event System Service contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2022-41082Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2022-41040Microsoft Exchange Server Server-Side Request Forgery VulnerabilityMicrosoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2010-2568Microsoft Windows Remote Code Execution VulnerabilityMicrosoft Windows incorrectly parses shortcuts in such a way that malicious code may be executed when the operating system displays the icon of a malicious shortcut file. An attacker who successfully exploited this vulnerability could execute code as the logged-on user.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-37969Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityMicrosoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Active Directory
CVE-2022-26923Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityAn authenticated user could manipulate attributes on computer accounts they own or manage, and acquire a certificate from Active Directory Certificate Services that would allow for privilege escalation to SYSTEM.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-21971Microsoft Windows Runtime Remote Code Execution VulnerabilityMicrosoft Windows Runtime contains an unspecified vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-34713Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityA remote code execution vulnerability exists when Microsoft Windows MSDT is called using the URL protocol from a calling application.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-22047Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation VulnerabilityMicrosoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-26925Microsoft Windows LSA Spoofing VulnerabilityMicrosoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.CISA’s required actionApply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch]. - Microsoft Windows
CVE-2022-30190Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution VulnerabilityA remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2013-1331Microsoft Office Buffer Overflow VulnerabilityMicrosoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via crafted PNG data in an Office document.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2012-4969Microsoft Internet Explorer Use-After-Free VulnerabilityMicrosoft Internet Explorer contains a use-after-free vulnerability that allows remote attackers to execute code via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft XML Core Services
CVE-2012-1889Microsoft XML Core Services Memory Corruption VulnerabilityMicrosoft XML Core Services contains a memory corruption vulnerability which could allow for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2012-0151Microsoft Windows Authenticode Signature Verification Remote Code Execution VulnerabilityThe Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.CISA’s required actionApply updates per vendor instructions. - Microsoft PowerPoint
CVE-2010-2572Microsoft PowerPoint Buffer Overflow VulnerabilityMicrosoft PowerPoint contains a buffer overflow vulnerability that alllows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2009-0563Microsoft Office Buffer Overflow VulnerabilityMicrosoft Office contains a buffer overflow vulnerability that allows remote attackers to execute code via a Word document with a crafted tag containing an invalid length field.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2009-0557Microsoft Office Object Record Corruption VulnerabilityMicrosoft Office contains an object record corruption vulnerability that allows remote attackers to execute code via a crafted Excel file with a malformed record object.CISA’s required actionApply updates per vendor instructions. - Microsoft Word
CVE-2006-2492Microsoft Word Malformed Object Pointer VulnerabilityMicrosoft Word and Microsoft Works Suites contain a malformed object pointer which allows attackers to execute code.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2016-7256Microsoft Windows Open Type Font Remote Code Execution VulnerabilityA remote code execution vulnerability exists when the Windows font library improperly handles specially crafted embedded fonts. An attacker who successfully exploits this vulnerability could take control of the affected system.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2016-3393Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution VulnerabilityA remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.CISA’s required actionApply updates per vendor instructions. - Microsoft Silverlight
CVE-2016-0034Microsoft Silverlight Runtime Remote Code Execution VulnerabilityMicrosoft Silverlight mishandles negative offsets during decoding, which allows attackers to execute remote code or cause a denial-of-service (DoS).CISA’s required actionThe impacted products are end-of-life and should be disconnected if still in use. - Microsoft Windows
CVE-2015-6175Microsoft Windows Kernel Privilege Escalation VulnerabilityThe kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2015-2425Microsoft Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause denial-of-service (DoS).CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2015-2360Microsoft Win32k Privilege Escalation VulnerabilityWin32k.sys in the kernel-mode drivers in Microsoft Windows allows local users to gain privileges or cause denial-of-service (DoS).CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2015-1769Microsoft Windows Mount Manager Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2015-1671Microsoft Windows Remote Code Execution VulnerabilityA remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2015-0071Microsoft Internet Explorer ASLR Bypass VulnerabilityMicrosoft Internet Explorer allows remote attackers to bypass the address space layout randomization (ASLR) protection mechanism via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2015-0016Microsoft Windows TS WebProxy Directory Traversal VulnerabilityDirectory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2014-4148Microsoft Windows Remote Code Execution VulnerabilityA remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2014-4123Microsoft Internet Explorer Privilege Escalation VulnerabilityMicrosoft Internet Explorer contains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft Input Method Editor (IME) Japanese
CVE-2014-4077Microsoft IME Japanese Privilege Escalation VulnerabilityMicrosoft Input Method Editor (IME) Japanese is a keyboard with Japanese characters that can be enabled on Windows systems as it is included by default (with the default set as disabled). IME Japanese contains an unspecified vulnerability when IMJPDCT.EXE (IME for Japanese) is installed which allows attackers to bypass a sandbox and perform privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2014-2817Microsoft Internet Explorer Privilege Escalation VulnerabilityMicrosoft Internet Explorer cotains an unspecified vulnerability that allows remote attackers to gain privileges via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2013-7331Microsoft Internet Explorer Information Disclosure VulnerabilityAn information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.CISA’s required actionApply updates per vendor instructions. - Microsoft Silverlight
CVE-2013-3896Microsoft Silverlight Information Disclosure VulnerabilityMicrosoft Silverlight does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Microsoft Silverlight
CVE-2013-0074Microsoft Silverlight Double Dereference VulnerabilityMicrosoft Silverlight does not properly validate pointers during HTML object rendering, which allows remote attackers to execute code via a crafted Silverlight application.CISA’s required actionThe impacted product is end-of-life and should be disconnected if still in use. - Microsoft Windows
CVE-2018-8611Microsoft Windows Kernel Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2017-8543Microsoft Windows Search Remote Code Execution VulnerabilityMicrosoft Windows allows an attacker to take control of the affected system when Windows Search fails to handle objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2017-0210Microsoft Internet Explorer Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2017-0149Microsoft Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code or cause a denial-of-service (DoS) via a crafted website.CISA’s required actionApply updates per vendor instructions. - Microsoft SMBv1 server
CVE-2017-0147Microsoft Windows SMBv1 Information Disclosure VulnerabilityThe SMBv1 server in Microsoft Windows allows remote attackers to obtain sensitive information from process memory via a crafted packet.CISA’s required actionApply updates per vendor instructions. - Microsoft XML Core Services
CVE-2017-0022Microsoft XML Core Services Information Disclosure VulnerabilityMicrosoft XML Core Services (MSXML) improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2017-0005Microsoft Windows Graphics Device Interface (GDI) Privilege Escalation VulnerabilityThe Graphics Device Interface (GDI) in Microsoft Windows allows local users to gain privileges via a crafted application.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer and Edge
CVE-2016-3351Microsoft Internet Explorer and Edge Information Disclosure VulnerabilityAn information disclosure vulnerability exists in the way that certain functions in Internet Explorer and Edge handle objects in memory. The vulnerability could allow an attacker to detect specific files on the user's computer.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2016-3298Microsoft Internet Explorer Messaging API Information Disclosure VulnerabilityAn information disclosure vulnerability exists when the Microsoft Internet Messaging API improperly handles objects in memory. An attacker who successfully exploited this vulnerability could allow the attacker to test for the presence of files on disk.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2016-0162Microsoft Internet Explorer Information Disclosure VulnerabilityAn information disclosure vulnerability exists when Internet Explorer does not properly handle JavaScript. The vulnerability could allow an attacker to detect specific files on the user's computer.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2020-1027Microsoft Windows Kernel Privilege Escalation VulnerabilityAn elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.CISA’s required actionApply updates per vendor instructions. - Microsoft Update Notification Manager
CVE-2020-0638Microsoft Update Notification Manager Privilege Escalation VulnerabilityMicrosoft Update Notification Manager contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1385Microsoft Windows AppX Deployment Extensions Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in access to system files.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1130Microsoft Windows AppX Deployment Service Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-0880Microsoft Windows Privilege Escalation VulnerabilityA local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls. An attacker who successfully exploited the vulnerability could elevate privileges on an affected system from low-integrity to medium-integrity.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-0703Microsoft Windows SMB Information Disclosure VulnerabilityAn information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, which could lead to information disclosure from the server.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2019-0676Microsoft Internet Explorer Information Disclosure VulnerabilityAn information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2018-8589Microsoft Win32k Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when Windows improperly handles calls to Win32k.sys. An attacker who successfully exploited this vulnerability could run remote code in the security context of the local system.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2014-4113Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2014-0322Microsoft Internet Explorer Use-After-Free VulnerabilityUse-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute code.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-26904Microsoft Windows User Profile Service Privilege Escalation VulnerabilityMicrosoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-21919Microsoft Windows User Profile Service Privilege Escalation VulnerabilityMicrosoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2021-41357Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2021-40450Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-22718Microsoft Windows Print Spooler Privilege Escalation VulnerabilityMicrosoft Windows Print Spooler contains an unspecified vulnerability which allow for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-24521Microsoft Windows CLFS Driver Privilege Escalation VulnerabilityMicrosoft Windows Common Log File System (CLFS) Driver contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2015-2502Microsoft Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability that allows an attacker to execute code or cause a denial-of-service (DoS).CISA’s required actionApply updates per vendor instructions. - Microsoft Active Directory
CVE-2021-42287Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityMicrosoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Active Directory
CVE-2021-42278Microsoft Active Directory Domain Services Privilege Escalation VulnerabilityMicrosoft Active Directory Domain Services contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft HTTP Protocol Stack
CVE-2021-31166Microsoft HTTP Protocol Stack Remote Code Execution VulnerabilityMicrosoft HTTP Protocol Stack contains a vulnerability in http.sys that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft SMBv1 server
CVE-2017-0148Microsoft SMBv1 Server Remote Code Execution VulnerabilityThe SMBv1 server in Microsoft allows remote attackers to execute arbitrary code via crafted packets.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-34484Microsoft Windows User Profile Service Privilege Escalation VulnerabilityMicrosoft Windows User Profile Service contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2021-38646Microsoft Office Access Connectivity Engine Remote Code Execution VulnerabilityMicrosoft Office Access Connectivity Engine contains an unspecified vulnerability which can allow for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-34486Microsoft Windows Event Tracing Privilege Escalation VulnerabilityMicrosoft Windows Event Tracing contains an unspecified vulnerability which can allow for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2018-8440Microsoft Windows Privilege Escalation VulnerabilityAn elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC).CISA’s required actionApply updates per vendor instructions. - Microsoft DirectX Graphics Kernel (DXGKRNL)
CVE-2018-8406Microsoft DirectX Graphics Kernel Privilege Escalation VulnerabilityAn elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft DirectX Graphics Kernel (DXGKRNL)
CVE-2018-8405Microsoft DirectX Graphics Kernel Privilege Escalation VulnerabilityAn elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2017-0213Microsoft Windows Privilege Escalation VulnerabilityMicrosoft Windows COM Aggregate Marshaler allows for privilege escalation when an attacker runs a specially crafted application.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2017-0059Microsoft Internet Explorer Information Disclosure VulnerabilityMicrosoft Internet Explorer allow remote attackers to obtain sensitive information from process memory via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft Edge and Internet Explorer
CVE-2017-0037Microsoft Edge and Internet Explorer Type Confusion VulnerabilityMicrosoft Edge and Internet Explorer have a type confusion vulnerability in mshtml.dll, which allows remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Edge
CVE-2016-7201Microsoft Edge Memory Corruption VulnerabilityThe Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft Edge
CVE-2016-7200Microsoft Edge Memory Corruption VulnerabilityThe Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2016-0189Microsoft Internet Explorer Memory Corruption VulnerabilityThe Microsoft JScript nd VBScript engines, as used in Internet Explorer and other products, allow attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft Client-Server Run-time Subsystem (CSRSS)
CVE-2016-0151Microsoft Windows CSRSS Security Feature Bypass VulnerabilityThe Client-Server Run-time Subsystem (CSRSS) in Microsoft mismanages process tokens, which allows local users to gain privileges via a crafted application.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2016-0040Microsoft Windows Kernel Privilege Escalation VulnerabilityThe kernel in Microsoft Windows allows local users to gain privileges via a crafted application.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2015-2426Microsoft Windows Adobe Type Manager Library Remote Code Execution VulnerabilityA remote code execution vulnerability exists in Microsoft Windows when the Windows Adobe Type Manager Library improperly handles specially crafted OpenType fonts.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2015-2419Microsoft Internet Explorer Memory Corruption VulnerabilityJScript in Microsoft Internet Explorer allows remote attackers to execute remote code or cause a denial of service (memory corruption) via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2015-1770Microsoft Office Uninitialized Memory Use VulnerabilityMicrosoft Office allows remote attackers to execute arbitrary code via a crafted Office document.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2013-3660Microsoft Win32k Privilege Escalation VulnerabilityThe EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft does not properly initialize a pointer for the next object in a certain list, which allows local users to gain privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2013-2551Microsoft Internet Explorer Use-After-Free VulnerabilityUse-after-free vulnerability in Microsoft Internet Explorer allows remote attackers to execute remote code via a crafted web site that triggers access to a deleted object.CISA’s required actionApply updates per vendor instructions. - Microsoft Word
CVE-2012-2539Microsoft Word Remote Code Execution VulnerabilityMicrosoft Word allows attackers to execute remote code or cause a denial-of-service (DoS) via crafted RTF data.CISA’s required actionApply updates per vendor instructions. - Microsoft Ancillary Function Driver (afd.sys)
CVE-2011-2005Microsoft Ancillary Function Driver (afd.sys) Improper Input Validation Vulnerabilityafd.sys in the Ancillary Function Driver in Microsoft Windows does not properly validate user-mode input passed to kernel mode, which allows local users to gain privileges via a crafted application.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2010-4398Microsoft Windows Kernel Stack-Based Buffer Overflow VulnerabilityStack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows allows local users to gain privileges, and bypass the User Account Control (UAC) feature.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2022-21999Microsoft Windows Print Spooler Privilege Escalation VulnerabilityMicrosoft Windows Print Spooler contains an unspecified vulnerability which can allow for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Graphics Device Interface (GDI)
CVE-2019-0903Microsoft GDI Remote Code Execution VulnerabilityA remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory. An attacker who successfully exploited this vulnerability could take control of the affected system.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2018-8414Microsoft Windows Shell Remote Code Execution VulnerabilityA remote code execution vulnerability exists when the Windows Shell does not properly validate file paths.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer Scripting Engine
CVE-2018-8373Microsoft Scripting Engine Memory Corruption VulnerabilityA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2017-0146Microsoft Windows SMB Remote Code Execution VulnerabilityThe SMBv1 server in Microsoft Windows allows remote attackers to perform remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2014-6332Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution VulnerabilityOleAut32.dll in OLE in Microsoft Windows allows remote attackers to remotely execute code via a crafted web site.CISA’s required actionApply updates per vendor instructions. - Microsoft Kerberos Key Distribution Center (KDC)
CVE-2014-6324Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation VulnerabilityThe Kerberos Key Distribution Center (KDC) in Microsoft allows remote authenticated domain users to obtain domain administrator privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1405Microsoft Windows Universal Plug and Play (UPnP) Service Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when the Windows UPnP service improperly allows COM object creation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1322Microsoft Windows Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1315Microsoft Windows Error Reporting Manager Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when Windows Error Reporting manager improperly handles hard links. An attacker who successfully exploited this vulnerability could overwrite a targeted file leading to an elevated status.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1253Microsoft Windows AppX Deployment Server Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when the Windows AppX Deployment Server improperly handles junctions.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2019-1132Microsoft Win32k Privilege Escalation VulnerabilityA privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1129Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.CISA’s required actionApply updates per vendor instructions. - Microsoft Task Scheduler
CVE-2019-1069Microsoft Task Scheduler Privilege Escalation VulnerabilityA privilege escalation vulnerability exists in the way the Task Scheduler Service validates certain file operations.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1064Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-0841Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when Windows AppXSVC improperly handles hard links. An attacker who successfully exploited this vulnerability could run processes in an elevated context.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-0543Microsoft Windows Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when Windows improperly handles authentication requests. An attacker who successfully exploited this vulnerability could run processes in an elevated context.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2018-8120Microsoft Win32k Privilege Escalation VulnerabilityA privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2017-0101Microsoft Windows Transaction Manager Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when the Windows Transaction Manager improperly handles objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2016-3309Microsoft Windows Kernel Privilege Escalation VulnerabilityA privilege escalation vulnerability exists when the Windows kernel fails to properly handle objects in memory. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2015-2546Microsoft Win32k Memory Corruption VulnerabilityThe kernel-mode driver in Microsoft Windows OS and Server allows local users to gain privileges via a crafted application.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-41379Microsoft Windows Installer Privilege Escalation VulnerabilityMicrosoft Windows Installer contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Excel
CVE-2019-1297Microsoft Excel Remote Code Execution VulnerabilityA remote code execution vulnerability exists in Microsoft Excel when the software fails to properly handle objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2018-8581Microsoft Exchange Server Privilege Escalation VulnerabilityA privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2017-11826Microsoft Office Remote Code Execution VulnerabilityA remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Microsoft Malware Protection Engine
CVE-2017-8540Microsoft Malware Protection Engine Improper Restriction of Operations VulnerabilityThe Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, Microsoft Exchange Server 2013 and 2016, does not properly scan a specially crafted file leading to memory corruption. aka "Microsoft Malware Protection Engine Remote Code Execution Vulnerability".CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2017-0261Microsoft Office Use-After-Free VulnerabilityMicrosoft Office contains a use-after-free vulnerability which can allow for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Graphics Device Interface (GDI)
CVE-2017-0001Microsoft Graphics Device Interface (GDI) Privilege Escalation VulnerabilityThe Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607 allows local users to gain privilegesCISA’s required actionApply updates per vendor instructions. - Microsoft Excel
CVE-2016-7262Microsoft Office Security Feature Bypass VulnerabilityA security feature bypass vulnerability exists when Microsoft Office improperly handles input. An attacker who successfully exploited the vulnerability could execute arbitrary commands.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2016-7193Microsoft Office Memory Corruption VulnerabilityMicrosoft Office contains a memory corruption vulnerability which can allow for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2016-0099Microsoft Windows Secondary Logon Service Privilege Escalation VulnerabilityA privilege escalation vulnerability exists in Microsoft Windows if the Windows Secondary Logon Service fails to properly manage request handles in memory. An attacker who successfully exploited this vulnerability could run arbitrary code as an administrator.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2015-2545Microsoft Office Malformed EPS File VulnerabilityMicrosoft Office allows remote attackers to execute arbitrary code via a crafted EPS image.CISA’s required actionApply updates per vendor instructions. - Microsoft PowerPoint
CVE-2015-2424Microsoft PowerPoint Memory Corruption VulnerabilityMicrosoft PowerPoint allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted Office document.CISA’s required actionApply updates per vendor instructions. - Microsoft ATM Font Driver
CVE-2015-2387Microsoft ATM Font Driver Privilege Escalation VulnerabilityATMFD.DLL in the Adobe Type Manager Font Driver in Microsoft Windows Server allows local users to gain privileges via a crafted application.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2015-1701Microsoft Win32k Privilege Escalation VulnerabilityAn unspecified vulnerability exists in the Win32k.sys kernel-mode driver in Microsoft Windows Server that allows a local attacker to execute arbitrary code with elevated privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2015-1642Microsoft Office Memory Corruption VulnerabilityMicrosoft Office contains a memory corruption vulnerability that allows remote attackers to execute arbitrary code via a crafted document.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2014-4114Microsoft Windows Object Linking & Embedding (OLE) Remote Code Execution VulnerabilityA vulnerability exists in Windows Object Linking & Embedding (OLE) that could allow remote code execution if a user opens a file that contains a specially crafted OLE object.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2013-5065Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft Windows NDProxy.sys in the kernel contains an improper input validation vulnerability which can allow a local attacker to escalate privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2013-3897Microsoft Internet Explorer Use-After-Free VulnerabilityA use-after-free vulnerability exists within CDisplayPointer in Microsoft Internet Explorer that allows an attacker to remotely execute arbitrary code.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2013-1347Microsoft Internet Explorer Remote Code Execution VulnerabilityThis vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2012-1856Microsoft Office MSCOMCTL.OCX Remote Code Execution VulnerabilityThe TabStrip ActiveX control in the Common Controls in MSCOMCTL.OCX in Microsoft Office allows remote attackers to execute arbitrary code via a crafted (1) document or (2) web page that triggers system-state corruption.CISA’s required actionApply updates per vendor instructions. - Microsoft Forefront Threat Management Gateway (TMG)
CVE-2011-1889Microsoft Forefront TMG Remote Code Execution VulnerabilityA remote code execution vulnerability exists in the Forefront Threat Management Gateway (TMG) Firewall Client Winsock provider that could allow code execution in the security context of the client application.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2010-3333Microsoft Office Stack-based Buffer Overflow VulnerabilityA stack-based buffer overflow vulnerability exists in the parsing of RTF data in Microsoft Office and earlier allows an attacker to perform remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2010-0232Microsoft Windows Kernel Exception Handler VulnerabilityThe kernel in Microsoft Windows, when access to 16-bit applications is enabled on a 32-bit x86 platform, does not properly validate certain BIOS calls, which allows local users to gain privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Excel
CVE-2009-3129Microsoft Excel Featheader Record Memory Corruption VulnerabilityMicrosoft Office Excel allows remote attackers to execute arbitrary code via a spreadsheet with a FEATHEADER record containing an invalid cbHdrData size element that affects a pointer offset.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2009-1123Microsoft Windows Improper Input Validation VulnerabilityThe kernel in Microsoft Windows does not properly validate changes to unspecified kernel objects, which allows local users to gain privileges via a crafted application.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2004-0210Microsoft Windows Privilege Escalation VulnerabilityA privilege elevation vulnerability exists in the POSIX subsystem. This vulnerability could allow a logged on user to take complete control of the system.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2002-0367Microsoft Windows Privilege Escalation Vulnerabilitysmss.exe debugging subsystem in Microsoft Windows does not properly authenticate programs that connect to other programs, which allows local users to gain administrator or SYSTEM privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2017-8570Microsoft Office Remote Code Execution VulnerabilityA remote code execution vulnerability exists in Microsoft Office software when it fails to properly handle objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2017-0222Microsoft Internet Explorer Remote Code Execution VulnerabilityA remote code execution vulnerability exists when Internet Explorer improperly accesses objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2014-6352Microsoft Windows Code Injection VulnerabilityMicrosoft Windows allow remote attackers to execute arbitrary code via a crafted OLE object.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2019-0752Microsoft Internet Explorer Type Confusion VulnerabilityA remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet ExplorerCISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2018-8174Microsoft Windows VBScript Engine Out-of-Bounds Write VulnerabilityA remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution"CISA’s required actionApply updates per vendor instructions. - Microsoft Word
CVE-2014-1761Microsoft Word Memory Corruption VulnerabilityMicrosoft Word contains a memory corruption vulnerability which when exploited could allow for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Graphics Component
CVE-2013-3906Microsoft Graphics Component Memory Corruption VulnerabilityMicrosoft Graphics Component contains a memory corruption vulnerability which can allow for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-36934Microsoft Windows SAM Local Privilege Escalation VulnerabilityIf a Volume Shadow Copy (VSS) shadow copy of the system drive is available, users can read the SAM file which would allow any user to escalate privileges to SYSTEM level.CISA’s required actionApply updates per vendor instructions. - Microsoft SMBv3
CVE-2020-0796Microsoft SMBv3 Remote Code Execution VulnerabilityA remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests. An attacker who successfully exploited the vulnerability could gain the ability to execute code on the target server or client.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2017-8464Microsoft Windows Shell (.lnk) Remote Code Execution VulnerabilityWindows Shell in multiple versions of Microsoft Windows allows local users or remote attackers to execute arbitrary code via a crafted .LNK fileCISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2017-0263Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains a privilege escalation vulnerability due to the Windows kernel-mode driver failing to properly handle objects in memory.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2017-0262Microsoft Office Remote Code Execution VulnerabilityA remote code execution vulnerability exists in Microsoft Office.CISA’s required actionApply updates per vendor instructions. - Microsoft SMBv1
CVE-2017-0145Microsoft SMBv1 Remote Code Execution VulnerabilityThe SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.CISA’s required actionApply updates per vendor instructions. - Microsoft SMBv1
CVE-2017-0144Microsoft SMBv1 Remote Code Execution VulnerabilityThe SMBv1 server in multiple Microsoft Windows versions allows remote attackers to execute arbitrary code via crafted packets.CISA’s required actionApply updates per vendor instructions. - Microsoft HTTP.sys
CVE-2015-1635Microsoft HTTP.sys Remote Code Execution VulnerabilityMicrosoft HTTP protocol stack (HTTP.sys) contains a vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2022-21882Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2020-0787Microsoft Windows Background Intelligent Transfer Service (BITS) Improper Privilege Management VulnerabilityMicrosoft Windows BITS is vulnerable to to a privilege elevation vulnerability if it improperly handles symbolic links. An actor can exploit this vulnerability to execute arbitrary code with system-level privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2014-1776Microsoft Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability that allows remote attackers to execute code in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2018-8453Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Windows Win32k contains a vulnerability that allows an attacker to escalate privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2021-33766Microsoft Exchange Server Information DisclosureMicrosoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2019-1458Microsoft Win32k Privilege Escalation VulnerabilityA privilege escalation vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k EoP.CISA’s required actionApply updates per vendor instructions. - Microsoft WinVerifyTrust function
CVE-2013-3900Microsoft WinVerifyTrust function Remote Code ExecutionA remote code execution vulnerability exists in the way that the WinVerifyTrust function handles Windows Authenticode signature verification for PE files.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-43890Microsoft Windows AppX Installer Spoofing VulnerabilityMicrosoft Windows AppX Installer contains a spoofing vulnerability which has a high impacts to confidentiality, integrity, and availability.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange
CVE-2021-42321Microsoft Exchange Server Remote Code Execution VulnerabilityAn authenticated attacker could leverage improper validation in cmdlet arguments within Microsoft Exchange and perform remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2021-42292Microsoft Excel Security Feature BypassA security feature bypass vulnerability in Microsoft Excel would allow a local user to perform arbitrary code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-40449Microsoft Windows Win32k Privilege Escalation VulnerabilityUnspecified vulnerability allows for an authenticated user to escalate privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft MSHTML
CVE-2021-40444Microsoft MSHTML Remote Code Execution VulnerabilityMicrosoft MSHTML contains a unspecified vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Open Management Infrastructure (OMI)
CVE-2021-38649Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityMicrosoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Open Management Infrastructure (OMI)
CVE-2021-38648Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityMicrosoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Open Management Infrastructure (OMI)
CVE-2021-38647Microsoft Open Management Infrastructure (OMI) Remote Code Execution VulnerabilityMicrosoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability allowing remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Open Management Infrastructure (OMI)
CVE-2021-38645Microsoft Open Management Infrastructure (OMI) Privilege Escalation VulnerabilityMicrosoft Open Management Infrastructure (OMI) within Azure VM Management Extensions contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-36955Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation VulnerabilityMicrosoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-36948Microsoft Windows Update Medic Service Privilege Escalation VulnerabilityMicrosoft Windows Update Medic Service contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-36942Microsoft Windows Local Security Authority (LSA) Spoofing VulnerabilityMicrosoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-34527Microsoft Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows Print Spooler contains an unspecified vulnerability due to the Windows Print Spooler service improperly performing privileged file operations. Successful exploitation allows an attacker to perform remote code execution with SYSTEM privileges. The vulnerability is also known under the moniker of PrintNightmare.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2021-34523Microsoft Exchange Server Privilege Escalation VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-34448Microsoft Windows Scripting Engine Memory Corruption VulnerabilityMicrosoft Windows Scripting Engine contains an unspecified vulnerability that allows for memory corruption.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-33771Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-33742Microsoft Windows MSHTML Platform Remote Code Execution VulnerabilityMicrosoft Windows MSHTML Platform contains an unspecified vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-33739Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation VulnerabilityMicrosoft Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-31979Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-31956Microsoft Windows NTFS Privilege Escalation VulnerabilityMicrosoft Windows New Technology File System (NTFS) contains an unspecified vulnerability that allows attackers to escalate privileges via a specially crafted application.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-31955Microsoft Windows Kernel Information Disclosure VulnerabilityMicrosoft Windows Kernel contains an unspecified vulnerability that allows for information disclosure. Successful exploitation allows attackers to read the contents of kernel memory from a user-mode process.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass.CISA’s required actionApply updates per vendor instructions. - Microsoft Enhanced Cryptographic Provider
CVE-2021-31201Microsoft Enhanced Cryptographic Provider Privilege Escalation VulnerabilityMicrosoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Enhanced Cryptographic Provider
CVE-2021-31199Microsoft Enhanced Cryptographic Provider Privilege Escalation VulnerabilityMicrosoft Enhanced Cryptographic Provider contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2021-28310Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Windows Win32k contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2021-27085Microsoft Internet Explorer Remote Code Execution VulnerabilityMicrosoft Internet Explorer contains an unspecified vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2021-27065Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2021-27059Microsoft Office Remote Code Execution VulnerabilityMicrosoft Office contains an unspecified vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2021-26858Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2021-26857Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2021-26855Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2021-26411Microsoft Internet Explorer Memory Corruption VulnerabilityMicrosoft Internet Explorer contains an unspecified vulnerability that allows for memory corruption.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2021-1732Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2021-1675Microsoft Windows Print Spooler Remote Code Execution VulnerabilityMicrosoft Windows Print Spooler contains an unspecified vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Defender
CVE-2021-1647Microsoft Defender Remote Code Execution VulnerabilityMicrosoft Defender contains an unspecified vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2020-17144Microsoft Exchange Server Remote Code Execution VulnerabilityMicrosoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2020-17087Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft Windows kernel contains an unspecified vulnerability that allows for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Netlogon
CVE-2020-1472Microsoft Netlogon Privilege Escalation VulnerabilityMicrosoft's Netlogon Remote Protocol (MS-NRPC) contains a privilege escalation vulnerability when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller. An attacker who successfully exploits the vulnerability could run a specially crafted application on a device on the network. The vulnerability is also known under the moniker of Zerologon.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2020-1464Microsoft Windows Spoofing VulnerabilityMicrosoft Windows contains a spoofing vulnerability when Windows incorrectly validates file signatures, allowing an attacker to bypass security features and load improperly signed files.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2020-1380Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2020-1350Microsoft Windows DNS Server Remote Code Execution VulnerabilityMicrosoft Windows DNS Servers fail to properly handle requests, allowing an attacker to perform remote code execution in the context of the Local System Account. The vulnerability is also known under the moniker of SIGRed.CISA’s required actionApply updates per vendor instructions. - Microsoft .NET Framework, SharePoint, Visual Studio
CVE-2020-1147Microsoft .NET Framework, SharePoint, and Visual Studio Remote Code Execution VulnerabilityMicrosoft .NET Framework, Microsoft SharePoint, and Visual Studio contain a remote code execution vulnerability when the software fails to check the source markup of XML file input. Successful exploitation allows an attacker to execute code in the context of the process responsible for deserialization of the XML content.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2020-1054Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains a privilege escalation vulnerability when the Windows kernel-mode driver fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.CISA’s required actionApply updates per vendor instructions. - Microsoft Hyper-V RemoteFX
CVE-2020-1040Microsoft Hyper-V RemoteFX vGPU Remote Code Execution VulnerabilityMicrosoft Hyper-V RemoteFX vGPU contains an improper input validation vulnerability due to the host server failing to properly validate input from an authenticated user on a guest operating system. Successful exploitation allows for remote code execution on the host operating system.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2020-1020Microsoft Windows Adobe Font Manager Library Remote Code Execution VulnerabilityMicrosoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2020-0986Microsoft Windows Kernel Privilege Escalation VulnerabilityMicrosoft Windows kernel contains an unspecified vulnerability when handling objects in memory that allows attackers to escalate privileges and execute code in kernel mode.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2020-0968Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2020-0938Microsoft Windows Adobe Font Manager Library Remote Code Execution VulnerabilityMicrosoft Windows Adobe Font Manager Library contains an unspecified vulnerability when handling specially crafted multi-master fonts (Adobe Type 1 PostScript format) that allows for remote code execution for all systems except Windows 10. For systems running Windows 10, an attacker who successfully exploited the vulnerability could execute code in an AppContainer sandbox context with limited privileges and capabilities.CISA’s required actionApply updates per vendor instructions. - Microsoft Edge and Internet Explorer
CVE-2020-0878Microsoft Edge and Internet Explorer Memory Corruption VulnerabilityMicrosoft Edge and Internet Explorer contain a memory corruption vulnerability that allows attackers to execute code in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Microsoft Exchange Server
CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution VulnerabilityMicrosoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2020-0683Microsoft Windows Installer Privilege Escalation VulnerabilityMicrosoft Windows Installer contains a privilege escalation vulnerability when MSI packages process symbolic links, which allows attackers to bypass access restrictions to add or remove files.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2020-0674Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability due to the way the Scripting Engine handles objects in memory. Successful exploitation could allow remote code execution in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Microsoft .NET Framework
CVE-2020-0646Microsoft .NET Framework Remote Code Execution VulnerabilityMicrosoft .NET Framework contains an improper input validation vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2020-0601Microsoft Windows CryptoAPI Spoofing VulnerabilityMicrosoft Windows CryptoAPI (Crypt32.dll) contains a spoofing vulnerability in the way it validates Elliptic Curve Cryptography (ECC) certificates. An attacker could exploit the vulnerability by using a spoofed code-signing certificate to sign a malicious executable, making it appear the file was from a trusted, legitimate source. A successful exploit could also allow the attacker to conduct man-in-the-middle attacks and decrypt confidential information on user connections to the affected software. The vulnerability is also known under the moniker of CurveBall.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2019-1429Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2019-1367Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability in how the scripting engine handles objects in memory. Successful exploitation allows for remote code execution in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1215Microsoft Windows Privilege Escalation VulnerabilityMicrosoft Windows contains an unspecified vulnerability due to the way ws2ifsl.sys (Winsock) handles objects in memory, allowing for privilege escalation. Successful exploitation allows an attacker to execute code with elevated privileges.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-1214Microsoft Windows Privilege Common Log File System (CLFS) Escalation VulnerabilityMicrosoft Windows Common Log File System (CLFS) driver improperly handles objects in memory which can allow for privilege escalation.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2019-0863Microsoft Windows Error Reporting (WER) Privilege Escalation VulnerabilityMicrosoft Windows Error Reporting (WER) contains a privilege escalation vulnerability due to the way it handles files, allowing for code execution in kernel mode.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2019-0859Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k fails to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2019-0808Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains a privilege escalation vulnerability due to the component failing to properly handle objects in memory. Successful exploitation allows an attacker to run code in kernel mode.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2019-0803Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains an unspecified vulnerability due to it failing to properly handle objects in memory causing privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2019-0797Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains a privilege escalation vulnerability when the Win32k component fails to properly handle objects in memory. Successful exploitation allows an attacker to execute code in kernel mode.CISA’s required actionApply updates per vendor instructions. - Microsoft Remote Desktop Services
CVE-2019-0708Microsoft Remote Desktop Services Remote Code Execution VulnerabilityMicrosoft Remote Desktop Services, formerly known as Terminal Service, contains an unspecified vulnerability that allows an unauthenticated attacker to connect to the target system using RDP and send specially crafted requests. Successful exploitation allows for remote code execution. The vulnerability is also known under the moniker of BlueKeep.CISA’s required actionApply updates per vendor instructions. - Microsoft SharePoint
CVE-2019-0604Microsoft SharePoint Remote Code Execution VulnerabilityMicrosoft SharePoint fails to check the source markup of an application package. An attacker who successfully exploits the vulnerability could run remote code in the context of the SharePoint application pool and the SharePoint server farm account.CISA’s required actionApply updates per vendor instructions. - Microsoft MSHTML
CVE-2019-0541Microsoft MSHTML Remote Code Execution VulnerabilityMicrosoft MSHTML engine contains an improper input validation vulnerability that allows for remote code execution vulnerability.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Explorer
CVE-2018-8653Microsoft Internet Explorer Scripting Engine Memory Corruption VulnerabilityMicrosoft Internet Explorer contains a memory corruption vulnerability due to how the Scripting Engine handles objects in memory, leading to remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2018-0802Microsoft Office Memory Corruption VulnerabilityMicrosoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0798.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2018-0798Microsoft Office Memory Corruption VulnerabilityMicrosoft Office contains a memory corruption vulnerability due to the way objects are handled in memory. Successful exploitation allows for remote code execution in the context of the current user. This vulnerability is known to be chained with CVE-2018-0802.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2017-11882Microsoft Office Memory Corruption VulnerabilityMicrosoft Office contains a memory corruption vulnerability that allows remote code execution in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2017-11774Microsoft Office Outlook Security Feature Bypass VulnerabilityMicrosoft Office Outlook contains a security feature bypass vulnerability due to improperly handling objects in memory. Successful exploitation allows an attacker to execute commands.CISA’s required actionApply updates per vendor instructions. - Microsoft .NET Framework
CVE-2017-8759Microsoft .NET Framework Remote Code Execution VulnerabilityMicrosoft .NET Framework contains a remote code execution vulnerability when processing untrusted input that could allow an attacker to take control of an affected system.CISA’s required actionApply updates per vendor instructions. - Microsoft Internet Information Services (IIS)
CVE-2017-7269Microsoft Windows Server Buffer Overflow VulnerabilityMicrosoft Windows Server 2003 R2 contains a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 which allows remote attackers to execute code via a long header beginning with "If: <http://" in a PROPFIND request.CISA’s required actionApply updates per vendor instructions. - Microsoft Office and WordPad
CVE-2017-0199Microsoft Office and WordPad Remote Code Execution VulnerabilityMicrosoft Office and WordPad contain an unspecified vulnerability due to the way the applications parse specially crafted files. Successful exploitation allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2017-0143Microsoft Windows Server Message Block (SMBv1) Remote Code Execution VulnerabilityMicrosoft Windows Server Message Block 1.0 (SMBv1) contains an unspecified vulnerability that allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2016-7255Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k kernel-mode driver fails to properly handle objects in memory which allows for privilege escalation. Successful exploitation allows an attacker to run code in kernel mode.CISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2016-3235Microsoft Office OLE DLL Side Loading VulnerabilityMicrosoft Office Object Linking & Embedding (OLE) dynamic link library (DLL) contains a side loading vulnerability due to it improperly validating input before loading libraries. Successful exploitation allows for remote code execution.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2016-0185Microsoft Windows Media Center Remote Code Execution VulnerabilityMicrosoft Windows Media Center contains a remote code execution vulnerability when Windows Media Center opens a specially crafted Media Center link (.mcl) file that references malicious code.CISA’s required actionApply updates per vendor instructions. - Microsoft Win32k
CVE-2016-0167Microsoft Win32k Privilege Escalation VulnerabilityMicrosoft Win32k contains an unspecified vulnerability that allows for privilege escalation via a crafted applicationCISA’s required actionApply updates per vendor instructions. - Microsoft Office
CVE-2015-1641Microsoft Office Memory Corruption VulnerabilityMicrosoft Office contains a memory corruption vulnerability due to failure to properly handle rich text format files in memory. Successful exploitation allows for remote code execution in the context of the current user.CISA’s required actionApply updates per vendor instructions. - Microsoft Windows
CVE-2014-1812Microsoft Windows Group Policy Preferences Password Privilege Escalation VulnerabilityMicrosoft Windows Active Directory contains a privilege escalation vulnerability due to the way it distributes passwords that are configured using Group Policy preferences. An authenticated attacker who successfully exploits the vulnerability could decrypt the passwords and use them to elevate privileges on the domain.CISA’s required actionApply updates per vendor instructions. - Microsoft MSCOMCTL.OCX
CVE-2012-0158Microsoft MSCOMCTL.OCX Remote Code Execution VulnerabilityMicrosoft MSCOMCTL.OCX contains an unspecified vulnerability that allows for remote code execution, allowing an attacker to take complete control of an affected system under the context of the current user.CISA’s required actionApply updates per vendor instructions.
From CISA’s Known Exploited Vulnerabilities catalog, updated 21 Oct 2026 (version 2026.10.21). CISA’s required actions are written for US government agencies. Microsoft on CISA’s site.