Microsoft vulnerabilities
We track 1,120 vulnerabilities in Microsoft products across 60+ products. 1,077 are rated high or critical, and 406 have been exploited in real attacks. The most recent was published on November 10, 2026.
Latest Microsoft vulnerabilities
- 9.8 Critical severity
Microsoft Open Management Infrastructure (OMI) Remote Code Execution Exploited
Open Management Infrastructure (OMI) Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Office Access Connectivity Engine Remote Code Execution Exploited
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Open Management Infrastructure (OMI) Privilege Escalation Exploited
Open Management Infrastructure Elevation of Privilege Vulnerability
- 7.8 High severity
Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Exploited
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- 7.8 High severity
Microsoft Windows Update Medic Service Privilege Escalation Exploited
Windows Update Medic Service Elevation of Privilege Vulnerability
- 7.5 High severity
Microsoft Windows Local Security Authority (LSA) Spoofing Exploited
Windows LSA Spoofing Vulnerability
- 7.8 High severity
Microsoft Windows Event Tracing Privilege Escalation Exploited
Windows Event Tracing Elevation of Privilege Vulnerability
- 7.8 High severity
Microsoft Windows User Profile Service Privilege Escalation Exploited
Windows User Profile Service Elevation of Privilege Vulnerability
- 7.8 High severity
Microsoft Windows SAM Local Privilege Escalation Exploited
An elevation of privilege vulnerability exists because of overly permissive Access Control Lists (ACLs) on multiple system files, including the Security Accounts Manager (SAM) database. An attacker who successfully exploited this vulnerability could run arbitr
- 8.8 High severity
Microsoft Windows Scripting Engine Memory Corruption Exploited
Scripting Engine Memory Corruption Vulnerability
- 9.8 Critical severity
Microsoft Exchange Server Privilege Escalation Exploited
Microsoft Exchange Server Elevation of Privilege Vulnerability
- 9.8 Critical severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Windows Kernel Privilege Escalation Exploited
Windows Kernel Elevation of Privilege Vulnerability
- 7.5 High severity
Microsoft Exchange Server Information Disclosure Exploited
Microsoft Exchange Server Information Disclosure Vulnerability
- 7.8 High severity
Microsoft Windows Kernel Privilege Escalation Exploited
Windows Kernel Elevation of Privilege Vulnerability
- 7.2 High severity
Microsoft Exchange Server Information Disclosure Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 8.8 High severity
Microsoft Windows Print Spooler Remote Code Execution Exploited
A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could the
- 8.8 High severity
Microsoft Windows MSHTML Platform Remote Code Execution Exploited
Windows MSHTML Platform Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Desktop Window Manager (DWM) Core Library Privilege Escalation Exploited
Microsoft DWM Core Library Elevation of Privilege Vulnerability
- 7.8 High severity
Microsoft Windows NTFS Privilege Escalation Exploited
Windows NTFS Elevation of Privilege Vulnerability
- 5.5 Medium severity
Microsoft Windows Kernel Information Disclosure Exploited
Windows Kernel Information Disclosure Vulnerability
- 7.8 High severity
Microsoft Enhanced Cryptographic Provider Privilege Escalation Exploited
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
- 7.8 High severity
Microsoft Enhanced Cryptographic Provider Privilege Escalation Exploited
Microsoft Enhanced Cryptographic Provider Elevation of Privilege Vulnerability
- 7.8 High severity
Microsoft Windows Print Spooler Remote Code Execution Exploited
Windows Print Spooler Remote Code Execution Vulnerability
- 6.6 Medium severity
Microsoft Exchange Server Security Feature Bypass Exploited
Microsoft Exchange Server Security Feature Bypass Vulnerability
- 9.8 Critical severity
Microsoft HTTP Protocol Stack Remote Code Execution Exploited
HTTP Protocol Stack Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Win32k Privilege Escalation Exploited
Win32k Elevation of Privilege Vulnerability
- 8.8 High severity
Microsoft Internet Explorer Remote Code Execution Exploited
Internet Explorer Remote Code Execution Vulnerability
- 6.5 Medium severity
Microsoft Office Remote Code Execution Exploited
Microsoft Office Remote Code Execution Vulnerability
- 8.8 High severity
Microsoft Internet Explorer Memory Corruption Exploited
Internet Explorer Memory Corruption Vulnerability
- 7.8 High severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 9.8 Critical severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Win32k Privilege Escalation Exploited
Windows Win32k Elevation of Privilege Vulnerability
- 7.8 High severity
Microsoft Defender Remote Code Execution Exploited
Microsoft Defender Remote Code Execution Vulnerability
- 8.8 High severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Windows Kernel Privilege Escalation Exploited
Windows Kernel Local Elevation of Privilege Vulnerability
- 8.8 High severity
Google Chromium V8 Type Confusion Exploited
Inappropriate implementation in V8 in Google Chrome prior to 86.0.4240.183 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page.
- 7.5 High severity
Microsoft Edge and Internet Explorer Memory Corruption Exploited
<p>A remote code execution vulnerability exists in the way that Microsoft browsers access objects in memory. The vulnerability could corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user. An attacker