Microsoft vulnerabilities

Published CVEs affecting Microsoft products: 5261 record(s), with severity, exploitation and fixes.

Windows Server 2025 3001 Windows Server 2025 (Server Core installation) 2993 Windows 11 Version 24H2 2879 Windows 11 24h2 2854 Windows 11 Version 25H2 2831 Windows Server 2022 2820 Windows 11 25h2 2806 Windows Server 2019 2708 Windows Server 2019 (Server Core installation) 2662 Windows 10 1809 2622 Windows 10 Version 1809 2595 Windows 10 Version 21H2 2572 Windows 11 version 26H1 2561 Windows 10 Version 22H2 2555 Windows 10 21h2 2549 Windows 10 22h2 2535 Windows 11 26h1 2514 Windows 11 version 23H2 2389 Windows 11 23h2 2362 Windows Server 2016 2297 Windows Server 2016 (Server Core installation) 2239 Windows 10 1607 2212 Windows 10 Version 1607 2177 Windows Server 2012 1885 Windows Server 2012 R2 1813 Windows Server 2012 R2 (Server Core installation) 1804 Windows Server 2012 (Server Core installation) 1699 Windows 11 Version 26H2 1007 Windows 11 26h2 978 Microsoft 365 Apps for Enterprise 576 365 Apps 575 Microsoft Office LTSC 2024 556 Microsoft Office LTSC 2021 553 Windows Server 2022 23h2 544 Windows Server 2022, 23H2 Edition (Server Core installation) 543 Office 2021 465 Office 2024 465 Microsoft Office LTSC for Mac 2021 454 Microsoft Office LTSC for Mac 2024 453 Microsoft Office 2019 386

Exploited only (KEV) →

CVE-2026-69851 Critical · 9.9 CWE-918 Aug 20, 2026

Microsoft Entra ID Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

CVE-2026-69836 Critical · 10.0 CWE-502 Aug 20, 2026

Microsoft Entra ID Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

CVE-2026-69558 High · 8.6 CWE-639 Aug 20, 2026

Microsoft Partner Center Information Disclosure Vulnerability

Authorization bypass through user-controlled key in Microsoft Partner Center allows an unauthorized attacker to disclose information over a network.

CVE-2026-69555 Critical · 10.0 CWE-863 Aug 20, 2026

Azure Arc Elevation of Privilege Vulnerability

Incorrect authorization in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-69543 High · 8.5 CWE-918 Aug 20, 2026

Azure Virtual Machines Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Azure Virtual Machines allows an authorized attacker to elevate privileges over a network.

CVE-2026-69519 High · 8.6 CWE-204 Aug 20, 2026

Azure Stack HCI Information Disclosure Vulnerability

Observable response discrepancy in Azure Stack HCI allows an unauthorized attacker to disclose information over a network.

CVE-2026-69419 High · 8.8 CWE-190 Aug 20, 2026

Azure Data Manager for Energy Remote Code Execution Vulnerability

Integer overflow or wraparound in Azure Data Manager for Energy allows an authorized attacker to execute code over a network.

CVE-2026-69400 Critical · 9.6 CWE-22 Aug 20, 2026

Azure Logic Apps Elevation of Privilege Vulnerability

Improper limitation of a pathname to a restricted directory ('path traversal') in Azure Logic Apps allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-68789 Critical · 9.9 CWE-89 Aug 20, 2026

Azure SQL Database Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

CVE-2026-68782 Critical · 9.9 CWE-89 Aug 20, 2026

Azure SQL Database Elevation of Privilege Vulnerability

Improper neutralization of special elements used in an sql command ('sql injection') in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

CVE-2026-66800 High · 7.5 CWE-918 Aug 20, 2026

Azure Data Factory Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Azure Data Factory allows an unauthorized attacker to disclose information over a network.

CVE-2026-66309 Critical · 9.1 CWE-284 Aug 20, 2026

Azure SQL Database Elevation of Privilege Vulnerability

Improper access control in Azure SQL Database allows an authorized attacker to elevate privileges over a network.

CVE-2026-65816 Critical · 10.0 CWE-706 Aug 20, 2026

Azure Arc Elevation of Privilege Vulnerability

Use of incorrectly-resolved name or reference in Azure Arc allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-65801 Critical · 10.0 CWE-918 Aug 20, 2026

Microsoft Exchange Online Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-65770 Critical · 10.0 CWE-88 Aug 20, 2026

Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

Improper neutralization of argument delimiters in a command ('argument injection') in Azure Managed Instance for Apache Cassandra allows an unauthorized attacker to execute code over a network.

CVE-2026-63509 High · 8.8 CWE-23 Aug 20, 2026

Microsoft Fabric Elevation of Privilege Vulnerability

Relative path traversal in Microsoft Fabric allows an authorized attacker to elevate privileges over a network.

CVE-2026-62834 Critical · 9.8 CWE-347 Aug 20, 2026

Azure Data Factory Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Azure Data Factory allows an unauthorized attacker to elevate privileges over a network.

CVE-2026-55015 Medium · 5.5 CWE-427 Aug 20, 2026

Microsoft Remote Help Denial of Service Vulnerability

Uncontrolled search path element in Windows Remote Help allows an authorized attacker to deny service locally.

CVE-2026-55013 High · 7.1 CWE-427 Aug 20, 2026

Windows Remote Help Defense Spoofing Vulnerability

Uncontrolled search path element in Windows Remote Help Defense allows an authorized attacker to perform spoofing locally.

CVE-2026-69550 Medium · 6.5 CWE-126 Aug 19, 2026

Windows App for Mac Information Disclosure Vulnerability

Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.

CVE-2026-62727 High · 7.0 CWE-362 Aug 19, 2026

Windows Telephony Service Elevation of Privilege Vulnerability

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

CVE-2026-24301 High · 7.5 CWE-77 Aug 18, 2026

Microsoft Copilot Information Disclosure Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to disclose information over a network.

CVE-2026-73851 Medium · 6.1 CWE-22 Aug 17, 2026

Kiota: Path traversal in generated plugin manifest static_template.file reference (percent-encoding bypass)

Kiota is an OpenAPI based HTTP Client code generator. Prior to 1.29.1 and 1.34.0, an attacker who controls or tampers with the OpenAPI description consumed by Kiota can supply a file reference that resolves outside the manifest package (e.g. ../../../../etc/passwd, an absolute path, or a file:// / http(s):// URI). When the generated manifest is deployed and consumed by an AI host, this can lead to inclusion or disclosure of files outside the intended package boundary. This vulnerability is fixed in 1.29.1 and 1.34.0.

CVE-2026-69414 High · 7.8 CWE-59 Aug 14, 2026

Microsoft Defender Elevation of Privilege Vulnerability

Microsoft is aware of an elevation of privilege in the Microsoft Malware Protection Engine in Microsoft Defender publicly referred to as "ShieldBreak ".

CVE-2026-50523 High · 7.8 CWE-77 Aug 14, 2026

Microsoft PowerShell Remote Code Execution Vulnerability

Improper neutralization of special elements used in a command ('command injection') in Microsoft PowerShell allows an authorized attacker to execute code locally.