Microsoft vulnerabilities
We track 1,120 vulnerabilities in Microsoft products across 60+ products. 1,077 are rated high or critical, and 406 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Microsoft vulnerabilities
- 7.8 High severity
Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
- 7.5 High severity
Remote Desktop client for Windows Desktop: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
- 7.5 High severity
Remote Desktop client for Windows Desktop: Out-of-bounds Write
Concurrent execution using shared resource with improper synchronization ('race condition') in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
- 7.0 High severity
Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization
Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.
- 8.1 High severity
Microsoft Teams for Android: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in output used by a downstream component ('injection') in Microsoft Teams for Android allows an authorized attacker to disclose information over a network.
- 8.4 High severity
Azure Stack Edge: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Stack Edge allows an authorized attacker to perform spoofing over a network.
- 8.8 High severity
Microsoft Dynamics 365 (on-premises) version 9.1: Improper Handling of Exceptional Conditions
Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.
- 8.8 High severity
Azure Kubernetes Service: Improper Limitation of a Pathname to a Restricted Directory
Improper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Azure Kubernetes Service allows an authorized attacker to execute code locally.
- 7.5 High severity
Copilot Chat (Microsoft Edge): Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in output used by a downstream component ('injection') in Copilot Chat (Microsoft Edge) allows an unauthorized attacker to disclose information over a network.
- 8.8 High severity
Microsoft 365 Copilot: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an authorized attacker to execute code over a network.
- 7.5 High severity
Microsoft 365 Copilot: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- 8.0 High severity
Microsoft SharePoint Enterprise Server 2016: Improper Neutralization of Special Elements used in an OS Command
Improper neutralization of special elements used in an os command ('os command injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- 8.8 High severity
UFO: Authentication Bypass by Spoofing
Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO's WebSocket control plane trusts client-supplied identity and role fields in task messages. A client connection can register as a n
- 8.1 High severity
UFO: Improper Limitation of a Pathname to a Restricted Directory
Microsoft UFO open-source framework for intelligent automation across devices and platforms. In 3.0.1-4-ge2626659, Microsoft UFO uses the user-controlled task_name value directly when constructing session log paths. An authenticated client can supply path trav
- 7.8 High severity
UFO: Improper Neutralization of Special Elements used in an OS Command
Microsoft UFO open-source framework for intelligent automation across devices and platforms. Microsoft UFO tagged releases up to and including v3.0.0 contain an OS command injection vulnerability in the shell action replay path. In affected releases, ShellRece
- 8.8 High severity
Microsoft SharePoint Server Deserialization of Untrusted Data Exploited
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- 7.5 High severity
Microsoft 365 Copilot: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.
- 9.3 Critical severity
Microsoft 365 Copilot for iOS: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
- 8.8 High severity
Azure Privileged Identity Management (PIM): Authorization Bypass Through User-Controlled Key
Authorization bypass through user-controlled key in Azure Privileged Identity Management (PIM) allows an authorized attacker to elevate privileges over a network.
- 9.8 Critical severity
Microsoft Entra: Authentication Bypass Using an Alternate Path or Channel
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
- 9.8 Critical severity
Microsoft Power Pages: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.
- 7.5 High severity
Microsoft Defender Denial of Service Exploited
Microsoft Defender Denial of Service Vulnerability
- 7.8 High severity
Microsoft Defender Link Following Exploited
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- 7.4 High severity
apm: Improper Link Resolution Before File Access
Microsoft APM is an open-source, community-driven dependency manager for AI agents. From 0.5.4 to 0.12.4, two primitive integrators in apm-cli enumerate package files with bare Path.glob() / Path.rglob() calls and read each match with Path.read_text(), transpa
- 7.1 High severity
apm: Improper Limitation of a Pathname to a Restricted Directory
Microsoft APM is an open-source, community-driven dependency manager for AI agents. Prior to 0.8.12, Microsoft APM normalizes marketplace plugins by copying plugin components referenced in plugin.json into .apm/. The manifest fields agents, skills, commands, a
- 6.1 Medium severity
Microsoft Exchange Server Cross-Site Scripting Exploited
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- 7.4 High severity
Microsoft Authenticator for Android: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network.
- 7.0 High severity
kiota-java: URL Redirection to Untrusted Site
The RedirectHandler middleware in microsoft/kiota-java (com.microsoft.kiota:microsoft-kiota-http-okHttp v1.9.0) and other Kiota libraries fails to strip sensitive HTTP headers when following 3xx redirects to a different host or scheme. Only the Authorization h
- 9.9 Critical severity
Microsoft Dynamics 365 (on-premises) version 9.1: Improper Control of Generation of Code
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
- 7.5 High severity
Microsoft Outlook for iOS: Improper Neutralization of Special Elements used in a Command
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to perform tampering over a network.
- 9.1 Critical severity
Microsoft Dynamics 365 (on-premises) version 9.1: Execution with Unnecessary Privileges
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.
- 8.8 High severity
Visual Studio Code: Improper Neutralization of Special Elements in Output Used by a Downstream Component
Improper neutralization of special elements in output used by a downstream component ('injection') in GitHub Copilot and Visual Studio allows an unauthorized attacker to bypass a security feature over a network.
- 9.1 Critical severity
Microsoft Confluence SAML SSO plugin: Incorrect Implementation of Authentication Algorithm
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network.
- 8.8 High severity
Microsoft Data Formulator: Improper Control of Generation of Code
Improper control of generation of code ('code injection') in Microsoft Data Formulator allows an unauthorized attacker to execute code over a network.
- 7.8 High severity
Windows 10 Version 21H2: External Control of File Name or Path
Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- 7.8 High severity
Windows 10 Version 1607: Stack-based Buffer Overflow
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.