microsoft vulnerabilities

Recent CVEs affecting microsoft products. 110 tracked.

microsoft has 110 tracked vulnerabilities, 16 critical and 5 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 108. Most recent: 2026-10-13. Highest priority: CVE-2019-1068 (score 86/100).

CVE-2026-66321 HIGH 7.4 UPGRADE Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una
CVE-2026-65802 HIGH 7.4 UPGRADE External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclos
CVE-2026-66312 MEDIUM 6.5 UPGRADE Buffer over-read in Microsoft Edge (Chromium-based) allows an authorized attacker to execute code over a netwo
CVE-2026-66315 HIGH 7.5 UPGRADE Use after free in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over a netwo
CVE-2026-66326 MEDIUM 6.5 UPGRADE Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to execute code over
CVE-2026-66318 HIGH 8.1 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose informa
CVE-2026-66310 HIGH 7.7 UPGRADE External control of file name or path in Microsoft Edge for Android allows an unauthorized attacker to disclos
CVE-2026-66314 MEDIUM 6.5 UPGRADE Time-of-check time-of-use (toctou) race condition in Microsoft Edge (Chromium-based) allows an unauthorized at
CVE-2026-65804 MEDIUM 6.1 UPGRADE Improper control of generation of code ('code injection') in Microsoft Edge (Chromium-based) allows an unautho
CVE-2026-66311 MEDIUM 6.2 UPGRADE Missing authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tampering
CVE-2026-68813 MEDIUM 5.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.
CVE-2026-66325 MEDIUM 6.1 UPGRADE Server-side request forgery (ssrf) in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perfo
CVE-2026-66322 HIGH 7.1 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing
CVE-2026-70310 MEDIUM 5.5 MITIGATE MITIGATE Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information locally.
CVE-2026-66313 MEDIUM 6.8 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tamperin
CVE-2026-66316 MEDIUM 5.4 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform spoofing
CVE-2026-66317 MEDIUM 5.4 UPGRADE Origin validation error in Microsoft Edge (Chromium-based) allows an unauthorized attacker to perform tamperin
CVE-2026-66803 CRITICAL 10.0 MITIGATE Improper access control in Azure Cosmos DB allows an unauthorized attacker to execute code over a network.
CVE-2026-56162 CRITICAL 10.0 MITIGATE Improper authentication in Azure SQL Database allows an unauthorized attacker to elevate privileges over a net
CVE-2026-63508 CRITICAL 10.0 MITIGATE Missing authentication for critical function in Microsoft Planetary Computer Pro allows an unauthorized attack
CVE-2026-65667 CRITICAL 10.0 MITIGATE Missing authorization in Microsoft Teams allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-50515 CRITICAL 9.9 MITIGATE Deserialization of untrusted data in Azure Service Bus allows an authorized attacker to execute code over a ne
CVE-2026-62873 CRITICAL 9.8 MITIGATE Improper verification of cryptographic signature in Microsoft 365 Admin Center allows an unauthorized attacker
CVE-2026-59115 CRITICAL 9.9 MITIGATE '.../...//' in Microsoft Entra Provisioning Service (SyncFabric) allows an authorized attacker to elevate priv
CVE-2026-50481 CRITICAL 9.9 MITIGATE Modification of assumed-immutable data (maid) in Azure Active Directory allows an authorized attacker to eleva
CVE-2026-62830 CRITICAL 9.9 MITIGATE Missing authorization in Azure SRE Agent allows an authorized attacker to elevate privileges over a network.
CVE-2026-62836 HIGH 8.7 MITIGATE Improper restriction of communication channel to intended endpoints in Azure SQL Managed Instance allows an un
CVE-2026-70332 CRITICAL 9.6 MITIGATE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Share
CVE-2026-49163 HIGH 8.8 MITIGATE Improper limitation of a pathname to a restricted directory ('path traversal') in Application Insights Profile
CVE-2026-56161 CRITICAL 9.6 MITIGATE Improper access control in Azure Logic Apps allows an authorized attacker to disclose information over a netwo
CVE-2026-62896 CRITICAL 9.6 MITIGATE Improper authentication in Microsoft Teams allows an authorized attacker to elevate privileges over a network.
CVE-2026-68823 CRITICAL 9.1 MITIGATE Exposed dangerous method or function in Azure Confidential Ledger allows an authorized attacker to execute cod
CVE-2026-59118 CRITICAL 9.3 MITIGATE Improper authorization in Copilot Cowork allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-65668 HIGH 8.8 MITIGATE Improper access control in Microsoft Purview eDiscovery allows an authorized attacker to elevate privileges ov
CVE-2026-62918 HIGH 7.5 MITIGATE Improper verification of cryptographic signature in Microsoft Teams allows an unauthorized attacker to perform
CVE-2026-65680 MEDIUM 6.7 UPGRADE Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized atta
CVE-2026-70339 MEDIUM 5.4 UPGRADE Access of resource using incompatible type ('type confusion') in Microsoft Edge (Chromium-based) allows an una
CVE-2026-69673 HIGH 7.8 UPGRADE UPGRADE Improper link resolution before file access ('link following') in Windows Update allows an authorized attacker
CVE-2026-69718 HIGH 7.8 UPGRADE UPGRADE Improper neutralization of special elements used in a command ('command injection') in Windows Update allows a
CVE-2026-69733 HIGH 7.8 UPGRADE UPGRADE Untrusted search path in Windows Update allows an authorized attacker to elevate privileges locally.
CVE-2026-108132 HIGH 7.0 UPGRADE UPGRADE Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
CVE-2026-108135 HIGH 7.0 UPGRADE UPGRADE Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized a
CVE-2026-108136 HIGH 7.8 UPGRADE UPGRADE Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges local
CVE-2026-108396 HIGH 7.0 UPGRADE UPGRADE Time-of-check time-of-use (toctou) race condition in Windows Modern Device Management (MDM) allows an authoriz
CVE-2026-59124 CRITICAL 9.8 UPGRADE Deserialization of untrusted data in Microsoft High Performance Computing (HPC) Pack allows an unauthorized at
CVE-2026-50516 CRITICAL 9.4 MITIGATE Incorrect authorization in Microsoft Azure Kubernetes Service allows an authorized attacker to elevate privile
CVE-2026-65815 HIGH 8.8 UPGRADE Deserialization of untrusted data in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to exe
CVE-2026-70321 HIGH 8.8 UPGRADE Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code
CVE-2026-59133 HIGH 8.8 UPGRADE Execution with unnecessary privileges in Microsoft High Performance Computing (HPC) Pack allows an authorized
CVE-2026-65768 HIGH 8.8 UPGRADE Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Teams for Android
CVE-2026-65811 HIGH 8.8 UPGRADE Improper input validation in Power BI allows an authorized attacker to execute code over a network.
CVE-2026-57104 HIGH 8.8 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Azure Storage Explorer
CVE-2026-62785 HIGH 8.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized atta
CVE-2026-62795 HIGH 8.8 UPGRADE UPGRADE Use after free in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to exec
CVE-2026-69320 HIGH 8.8 UPGRADE Improper neutralization of special elements used in an os command ('os command injection') in Visual Studio Co
CVE-2026-70326 HIGH 8.8 UPGRADE Server-side request forgery (ssrf) in Microsoft Office SharePoint allows an authorized attacker to elevate pri
CVE-2026-70336 HIGH 8.8 UPGRADE Improper control of generation of code ('code injection') in Visual Studio Code allows an unauthorized attacke
CVE-2026-59113 HIGH 8.8 UPGRADE Missing authorization in Visual Studio Code allows an unauthorized attacker to execute code over a network.
CVE-2026-65767 HIGH 8.8 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Teams for An
CVE-2026-70340 HIGH 8.1 UPGRADE Missing authorization in Azure CycleCloud allows an authorized attacker to elevate privileges over a network.
CVE-2026-47299 HIGH 7.2 UPGRADE Improper neutralization of special elements used in a command ('command injection') in Azure Monitor Agent all
CVE-2026-57105 HIGH 8.0 UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office Share
CVE-2026-62869 HIGH 8.8 MITIGATE Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoo
CVE-2026-69306 HIGH 8.2 UPGRADE Not failing securely ('failing open') in Visual Studio Code allows an unauthorized attacker to bypass a securi
CVE-2026-47285 MEDIUM 6.5 UPGRADE Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allo
CVE-2026-65769 MEDIUM 6.5 UPGRADE Exposure of sensitive information to an unauthorized actor in Microsoft Teams Mobile allows an unauthorized at
CVE-2026-66301 MEDIUM 6.5 UPGRADE Exposure of sensitive information to an unauthorized actor in Microsoft Dynamics 365 (on-premises) allows an a
CVE-2026-54981 HIGH 7.8 MITIGATE Inclusion of functionality from untrusted control sphere in Visual Studio Code - Python extension allows an un
CVE-2026-65675 HIGH 7.1 MITIGATE No cwe for this issue in Visual Studio Code CoPilot Chat Extension allows an unauthorized attacker to bypass a
CVE-2026-65806 MEDIUM 6.5 UPGRADE Missing authorization in Azure CycleCloud allows an authorized attacker to disclose information over a network
CVE-2026-70335 HIGH 7.8 UPGRADE Improper neutralization of special elements used in an os command ('os command injection') in GitHub Copilot a
CVE-2026-62772 HIGH 7.8 UPGRADE Heap-based buffer overflow in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized
CVE-2026-62799 HIGH 7.8 UPGRADE Heap-based buffer overflow in Windows SMB Client allows an authorized attacker to elevate privileges locally.
CVE-2026-58650 HIGH 7.8 UPGRADE Authorization bypass through user-controlled key in Visual Studio Code allows an unauthorized attacker to bypa
CVE-2026-63522 HIGH 7.8 MITIGATE Incorrect permission assignment for critical resource in Azure SQL Database allows an authorized attacker to e
CVE-2026-65673 HIGH 7.8 UPGRADE Incorrect authorization in Microsoft Entra Connect Sync allows an authorized attacker to elevate privileges ov
CVE-2026-69278 HIGH 7.8 UPGRADE Incorrect authorization in Visual Studio Code allows an unauthorized attacker to bypass a security feature loc
CVE-2026-68821 HIGH 7.3 UPGRADE Improper privilege management in Windows Package Manager allows an authorized attacker to elevate privileges l
CVE-2026-54123 MEDIUM 5.5 UPGRADE Exposure of sensitive information to an unauthorized actor in Microsoft Defender for Endpoint allows an author
CVE-2026-72971 MEDIUM 5.5 UPGRADE Improper link resolution before file access ('link following') in Windows Container Isolation FS Filter Driver
CVE-2026-62775 MEDIUM 5.5 UPGRADE Incorrect authorization in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized att
CVE-2026-83862 HIGH 8.8 UPGRADE UPGRADE Use after free in Windows Network Load Balancing allows an unauthorized attacker to execute code over an adjac
CVE-2026-68836 HIGH 7.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows kernel32.dll allows an authorized attacker to elevate privileges locally
CVE-2026-69326 HIGH 8.8 UPGRADE UPGRADE Heap-based buffer overflow in Graphic Fonts allows an unauthorized attacker to execute code over a network.
CVE-2026-69354 HIGH 7.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges loca
CVE-2026-69363 HIGH 8.0 UPGRADE UPGRADE Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges over
CVE-2026-69387 HIGH 7.0 UPGRADE UPGRADE Use after free in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-69452 HIGH 7.1 UPGRADE UPGRADE Use after free in Windows Enterprise App Management allows an authorized attacker to elevate privileges over a
CVE-2026-69471 HIGH 7.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
CVE-2026-69506 MEDIUM 4.7 UPGRADE UPGRADE Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information local
CVE-2026-69521 HIGH 8.8 UPGRADE UPGRADE Integer overflow or wraparound in Windows iSCSI allows an unauthorized attacker to execute code over a network
CVE-2022-24513 HIGH 7.8 UPGRADE UPGRADE Visual Studio Elevation of Privilege Vulnerability
CVE-2026-96303 MEDIUM 6.5 UPGRADE Improperly implemented security check for standard in Microsoft PowerShell allows an unauthorized attacker to
CVE-2026-96251 HIGH 8.8 UPGRADE Reliance on untrusted inputs in a security decision in Microsoft PowerShell allows an unauthorized attacker to
CVE-2026-96960 HIGH 7.5 UPGRADE DOWNGRADE Asymmetric resource consumption (amplification) in .NET allows an unauthorized attacker to deny service over a
CVE-2026-96959 HIGH 7.5 UPGRADE DOWNGRADE Allocation of resources without limits or throttling in .NET allows an unauthorized attacker to deny service o
CVE-2026-96958 HIGH 7.5 UPGRADE DOWNGRADE Inefficient algorithmic complexity in .NET allows an unauthorized attacker to deny service over a network.
CVE-2026-96957 HIGH 8.8 UPGRADE UPGRADE Improper verification of cryptographic signature in .NET allows an unauthorized attacker to bypass a security
CVE-2026-96222 HIGH 7.4 UPGRADE UPGRADE Improper certificate validation in Active Directory Federation Services (AD FS) allows an unauthorized attacke
CVE-2026-85790 MEDIUM 5.9 UPGRADE UPGRADE Use after free in Microsoft QUIC allows an unauthorized attacker to disclose information over a network.
CVE-2026-24301 HIGH 8.8 MITIGATE Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allow
CVE-2026-96912 HIGH 7.8 UPGRADE UPGRADE Use after free in Windows Client License Service allows an authorized attacker to elevate privileges locally.
CVE-2026-96911 HIGH 7.8 UPGRADE UPGRADE Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an
CVE-2026-96914 HIGH 8.8 UPGRADE UPGRADE Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized att
CVE-2026-96913 HIGH 8.8 UPGRADE UPGRADE Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-96951 HIGH 8.8 EXPLOITED MITIGATE UPGRADE Microsoft Windows Command Injection Vulnerability
CVE-2026-65660 HIGH 8.8 EXPLOITED UPGRADE Microsoft SharePoint Code Injection Vulnerability
CVE-2026-85880 HIGH 7.8 EXPLOITED UPGRADE UPGRADE Microsoft Windows Heap-Based Buffer Overflow Vulnerability
CVE-2026-81963 HIGH 7.8 EXPLOITED UPGRADE UPGRADE Microsoft Windows Link Following Vulnerability
CVE-2019-1068 HIGH 8.8 EXPLOITED DOWNGRADE UPGRADE Microsoft SQL Server Remote Code Execution Vulnerability

FAQ

How do I fix microsoft vulnerabilities?

Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.

Is microsoft being exploited right now?

Yes: 5 microsoft CVEs are on the CISA Known Exploited Vulnerabilities list, so patch those first.

Which microsoft CVE should I patch first?

CVE-2019-1068 currently ranks highest (86/100): Microsoft SQL Server Remote Code Execution Vulnerability.

Products

← Back to latest CVEs