Microsoft vulnerabilities
Published CVEs affecting Microsoft products: 5244 record(s), with severity, exploitation and fixes.
Windows Server 2025 3001Windows Server 2025 (Server Core installation) 2997Windows 11 Version 24H2 2883Windows 11 Version 25H2 2835Windows Server 2022 2820Windows Server 2019 2708Windows Server 2019 (Server Core installation) 2666Windows 10 Version 1809 2600Windows 10 Version 21H2 2576Windows 11 version 26H1 2565Windows 10 Version 22H2 2559Windows 11 24h2 2421Windows 11 version 23H2 2391Windows 11 25h2 2373Windows Server 2016 2297Windows 10 1809 2243Windows Server 2016 (Server Core installation) 2243Windows 10 Version 1607 2181Windows 10 21h2 2163Windows 10 22h2 2149Windows 11 26h1 2083Windows 11 23h2 1951Windows 10 1607 1901Windows Server 2012 1871Windows Server 2012 R2 1817Windows Server 2012 R2 (Server Core installation) 1808Windows Server 2012 (Server Core installation) 1703Windows 11 Version 26H2 1007Microsoft 365 Apps for Enterprise 577365 Apps 575Microsoft Office LTSC 2024 557Microsoft Office LTSC 2021 554Windows 11 26h2 550Windows Server 2022 23h2 544Windows Server 2022, 23H2 Edition (Server Core installation) 543Office 2021 465Office 2024 465Microsoft Office LTSC for Mac 2021 451Microsoft Office LTSC for Mac 2024 450Microsoft Office 2019 386
CVE-2026-69539
High · 7.5
CWE-416 Sep 8, 2026
Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
CVE-2026-69538
High · 7.8
CWE-125 Sep 8, 2026
Windows Spaceport.sys Remote Code Execution Vulnerability
Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to execute code locally.
CVE-2026-69536
High · 7.1
CWE-416 Sep 8, 2026
Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
CVE-2026-69535
High · 7.8
CWE-122 Sep 8, 2026
Windows Spaceport.sys Elevation of Privilege Vulnerability
Numeric truncation error in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
CVE-2026-69534
High · 7.8
CWE-77 Sep 8, 2026
Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVE-2026-69532
High · 7.8
CWE-125 Sep 8, 2026
Windows NTFS Elevation of Privilege Vulnerability
Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.
CVE-2026-69531
Medium · 5.5
CWE-441 Sep 8, 2026
Microsoft Windows Speech Tampering Vulnerability
Unintended proxy or intermediary ('confused deputy') in Microsoft Windows Speech allows an authorized attacker to perform tampering locally.
CVE-2026-69530
High · 8.1
CWE-416 Sep 8, 2026
Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution Vulnerability
Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.
CVE-2026-69529
High · 8.8
CWE-122 Sep 8, 2026
Microsoft Office Access Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Access allows an unauthorized attacker to execute code over a network.
CVE-2026-69528
High · 7.8
CWE-306 Sep 8, 2026
Windows Shell Elevation of Privilege Vulnerability
Missing authentication for critical function in Windows Shell allows an authorized attacker to elevate privileges locally.
CVE-2026-69527
Medium · 5.5
CWE-125 Sep 8, 2026
Windows USB Mass Storage Class Driver Information Disclosure Vulnerability
Out-of-bounds read in Windows USB Mass Storage Class Driver allows an authorized attacker to disclose information locally.
CVE-2026-69525
Critical · 9.8
CWE-416 Sep 8, 2026
Remote Desktop Services Remote Code Execution Vulnerability
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
CVE-2026-69524
High · 8.1
CWE-416 Sep 8, 2026
Windows Active Directory Domain Services Remote Code Execution Vulnerability
Use after free in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
CVE-2026-69522
High · 8.8
CWE-122 Sep 8, 2026
.NET and Visual Studio Remote Code Execution Vulnerability
Heap-based buffer overflow in Visual Studio allows an unauthorized attacker to execute code over a network.
CVE-2026-69518
High · 8.8
CWE-122 Sep 8, 2026
Windows Remote Desktop Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Remote Desktop allows an unauthorized attacker to execute code over a network.
CVE-2026-69517
High · 7.0
CWE-416 Sep 8, 2026
Windows Wireless Networking Elevation of Privilege Vulnerability
Use after free in Windows Wireless Networking allows an authorized attacker to elevate privileges locally.
CVE-2026-69516
High · 7.0
CWE-416 Sep 8, 2026
Connected Devices Platform Service (Cdpsvc) Elevation of Privilege Vulnerability
Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
CVE-2026-69514
High · 7.5
CWE-122 Sep 8, 2026
Remote Desktop Services Remote Code Execution Vulnerability
Heap-based buffer overflow in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.
CVE-2026-69513
High · 7.8
CWE-122 Sep 8, 2026
Windows Error Reporting Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
CVE-2026-69512
High · 8.8
CWE-122 Sep 8, 2026
Windows Spaceport.sys Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Spaceport.sys allows an authorized attacker to elevate privileges over a network.
CVE-2026-69511
High · 8.8
CWE-122 Sep 8, 2026
Microsoft Windows Media Foundation Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code over a network.
CVE-2026-69510
High · 8.1
CWE-121 Sep 8, 2026
Windows DHCP Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
CVE-2026-69509
High · 7.8
CWE-122 Sep 8, 2026
Role: Windows Fax Service Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Fax Service allows an authorized attacker to elevate privileges locally.
CVE-2026-69508
High · 7.8
CWE-121 Sep 8, 2026
Windows MIDI Service Module Elevation of Privileges Vulnerability
Stack-based buffer overflow in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally.
CVE-2026-69507
Medium · 5.7
CWE-538 Sep 8, 2026
Microsoft Windows Search Component Information Disclosure Vulnerability
Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized attacker to disclose information over a network.