Microsoft vulnerabilities
We track 1,120 vulnerabilities in Microsoft products across 60+ products. 1,077 are rated high or critical, and 406 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Microsoft vulnerabilities
- 7.0 High severity
Windows 11 version 23H2: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected User Experiences and Telemetry allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 21H2: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Feedback Hub allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1809: Stack-based Buffer Overflow
Stack-based buffer overflow in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1607: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Windows Task Scheduler allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 11 Version 24H2: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Diagnostic Policy Service allows an authorized attacker to elevate privileges locally.
- 7.5 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- 7.8 High severity
Windows 10 Version 1607: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Data Sharing Service Client allows an authorized attacker to elevate privileges locally.
- 8.8 High severity
Windows 10 Version 1809: Access of Resource Using Incompatible Type
Access of resource using incompatible type ('type confusion') in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1607: Missing Authentication for Critical Functionality
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vul
- 7.0 High severity
Windows 10 Version 1809: Weak Authentication
An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files. The vulnerability could allow elevation of privilege if an attacker can successfully exploit it. An attacker who successfully exploited the vul
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
- 9.0 Critical severity
Microsoft SharePoint Server Subscription Edition: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to elevate privileges over a network.
- 8.7 High severity
Microsoft JDBC Driver for SQL Server 13.4: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature in JDBC Driver for SQL Server allows an unauthorized attacker to bypass a security feature over a network.
- 8.8 High severity
Windows 10 Version 1607: Heap-based Buffer Overflow
Heap-based buffer overflow in Windows Network Connected Devices Auto-Setup Service allows an unauthorized attacker to execute code over an adjacent network.
- 8.8 High severity
Microsoft 365 Apps for Enterprise: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office Outlook allows an authorized attacker to execute code over a network.
- 6.5 Medium severity
Microsoft Office Outlook Missing User Interaction for Potentially Unsafe Action Exploited
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- 8.0 High severity
Windows 10 Version 1607: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Windows Active Directory allows an authorized attacker to elevate privileges over a network.
- 8.1 High severity
Microsoft Teams for Android: Improper Control of Generation of Code
Improper control of generation of code ('code injection') in Microsoft Teams for Android allows an unauthorized attacker to perform spoofing over a network.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
- 8.3 High severity
Visual Studio Code: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 8.6 High severity
Visual Studio Code: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Visual Studio Code allows an unauthorized attacker to execute code locally.
- 8.2 High severity
Azure Web Apps: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an authorized attacker to execute code over a network.
- 8.8 High severity
Visual Studio Code: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Visual Studio Code allows an unauthorized attacker to execute code over a network.
- 7.0 High severity
Windows 10 Version 1809: Time-of-check Time-of-use (TOCTOU) Race Condition
Time-of-check time-of-use (toctou) race condition in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- 8.1 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Internet Information Services allows an unauthorized attacker to execute code over a network.
- 7.0 High severity
Windows 10 Version 1607: Improper Link Resolution Before File Access
Improper link resolution before file access ('link following') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows Sandbox: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an os command ('os command injection') in Windows Sandbox allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 11 Version 24H2: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Audio Service allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows Server 2016: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Exposure of Sensitive System Information to an Unauthorized Control Sphere
Exposure of sensitive system information to an unauthorized control sphere in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
- 8.1 High severity
Windows 10 Version 1607: Improper Verification of Cryptographic Signature
Improper verification of cryptographic signature in Windows Remote Procedure Call Runtime allows an unauthorized attacker to execute code over a network.
- 8.8 High severity
Windows 10 Version 1809: Inclusion of Functionality from Untrusted Control Sphere
Inclusion of functionality from untrusted control sphere in Windows Advanced Rasterization Platform allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Client for NFS allows an authorized attacker to elevate privileges locally.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Point-to-Point Protocol over Ethernet (PPPoE) allows an authorized attacker to elevate privileges locally.
- 8.8 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 8.0 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.
- 8.0 High severity
Microsoft SQL Server 2017 (GDR): Improper Neutralization of Special Elements used in an SQL Command
Improper neutralization of special elements used in an sql command ('sql injection') in SQL Server allows an authorized attacker to elevate privileges over a network.