Vulnerabilidades exploradas (CISA KEV)

CVE-2026-96951 Alta · 8.8 KEV Alta · 52 CWE-77 13/10/2026

Microsoft Windows Command Injection Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-85880 Alta · 7.8 KEV Alta · 54 CWE-122 08/09/2026

Microsoft Windows Heap-Based Buffer Overflow Vulnerability

Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.

CVE-2026-81963 Alta · 7.8 KEV Alta · 46 CWE-59 08/09/2026

Microsoft Windows Link Following Vulnerability

Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

CVE-2026-68820 Alta · 7.0 KEV Alta · 51 Exploit público CWE-416 11/08/2026

Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-65660 Alta · 8.8 KEV Alta · 59 Exploit público CWE-94 11/08/2026

Microsoft SharePoint Code Injection Vulnerability

Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-55040 Crítica · 9.1 KEV Urgente · 73 Exploit público CWE-1390 14/07/2026

Microsoft SharePoint Weak Authentication Vulnerability

Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-58644 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-502 14/07/2026

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CVE-2026-56164 Crítica · 9.8 KEV Alta · 63 Exploit público CWE-306 14/07/2026

Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability

Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-56155 Alta · 7.8 KEV Alta · 45 CWE-1220 14/07/2026

Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability

Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.

CVE-2026-50522 Crítica · 9.8 KEV Alta · 67 Exploit público CWE-502 14/07/2026

Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.

CVE-2026-45659 Alta · 8.8 KEV Urgente · 70 Exploit público Ransomware CWE-502 22/05/2026

Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVE-2026-45498 Alta · 7.5 KEV Alta · 57 Exploit público CWE-400 20/05/2026

Microsoft Defender Denial of Service Vulnerability

CVE-2026-41091 Alta · 7.8 KEV Alta · 53 Exploit público CWE-59 20/05/2026

Microsoft Defender Link Following Vulnerability

Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.

CVE-2026-42897 Média · 6.1 KEV Alta · 50 Exploit público CWE-79 14/05/2026

Microsoft Exchange Server Cross-Site Scripting Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-33825 Alta · 7.8 KEV Alta · 62 Exploit público Ransomware CWE-1220 14/04/2026

Microsoft Defender Insufficient Granularity of Access Control Vulnerability

Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.

CVE-2026-33824 Crítica · 9.8 KEV Alta · 65 Exploit público CWE-415 14/04/2026

Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

CVE-2026-32201 Média · 6.5 KEV Alta · 62 Exploit público CWE-20 14/04/2026

Microsoft SharePoint Server Improper Input Validation Vulnerability

Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-32202 Média · 4.3 KEV Alta · 66 Exploit público CWE-693 14/04/2026

Microsoft Windows Protection Mechanism Failure Vulnerability

Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-21533 Alta · 7.8 KEV Alta · 61 Exploit público CWE-269 10/02/2026

Microsoft Windows Improper Privilege Management Vulnerability

Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

CVE-2026-21519 Alta · 7.8 KEV Alta · 54 CWE-843 10/02/2026

Microsoft Windows Type Confusion Vulnerability

Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVE-2026-21525 Média · 6.2 KEV Alta · 52 CWE-476 10/02/2026

Microsoft Windows NULL Pointer Dereference Vulnerability

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

CVE-2026-21514 Alta · 7.8 KEV Alta · 58 Exploit público CWE-807 10/02/2026

Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability

Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.

CVE-2026-21510 Alta · 8.8 KEV Alta · 62 Exploit público CWE-693 10/02/2026

Microsoft Windows Shell Protection Mechanism Failure Vulnerability

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-21513 Alta · 8.8 KEV Alta · 56 CWE-693 10/02/2026

Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

CVE-2026-21509 Alta · 7.8 KEV Alta · 62 Exploit público CWE-807 26/01/2026

Microsoft Office Security Feature Bypass Vulnerability

Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.