Vulnerabilidades de Microsoft
CVEs publicadas que afetam produtos de Microsoft: 5261 registro(s), com severidade, exploração e correções.
Windows Server 2025 3001Windows Server 2025 (Server Core installation) 2987Windows 11 Version 24H2 2873Windows 11 24h2 2856Windows 11 Version 25H2 2825Windows Server 2022 2820Windows 11 25h2 2808Windows Server 2019 2708Windows Server 2019 (Server Core installation) 2657Windows 10 1809 2624Windows 10 Version 1809 2590Windows 10 Version 21H2 2567Windows 11 version 26H1 2555Windows 10 21h2 2551Windows 10 Version 22H2 2550Windows 10 22h2 2537Windows 11 26h1 2516Windows 11 version 23H2 2383Windows 11 23h2 2364Windows Server 2016 2297Windows Server 2016 (Server Core installation) 2233Windows 10 1607 2214Windows 10 Version 1607 2171Windows Server 2012 1885Windows Server 2012 R2 1807Windows Server 2012 R2 (Server Core installation) 1798Windows Server 2012 (Server Core installation) 1693Windows 11 Version 26H2 1007Windows 11 26h2 980Microsoft 365 Apps for Enterprise 576365 Apps 575Microsoft Office LTSC 2024 554Microsoft Office LTSC 2021 551Windows Server 2022 23h2 544Windows Server 2022, 23H2 Edition (Server Core installation) 543Office 2021 465Office 2024 465Microsoft Office LTSC for Mac 2021 459Microsoft Office LTSC for Mac 2024 459Microsoft Office 2019 386
CVE-2026-20967
Alta · 8.8
CWE-20 10/03/2026
System Center Operations Manager (SCOM) Elevation of Privilege Vulnerability
Improper input validation in System Center Operations Manager allows an authorized attacker to elevate privileges over a network.
CVE-2026-26125
Crítica · 9.8
CWE-306 05/03/2026
Microsoft Payment Orchestrator Service - Elevação de Privilégio (CWE-306)
Vulnerabilidade de elevação de privilégio no Payment Orchestrator Service
CVE-2026-26124
Média · 6.7
CWE-22 05/03/2026
Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
'.../...//' in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
CVE-2026-26122
Média · 6.5
CWE-1188 05/03/2026
Microsoft ACI Confidential Containers Information Disclosure Vulnerability
Initialization of a resource with an insecure default in Azure Compute Gallery allows an authorized attacker to disclose information over a network.
CVE-2026-23651
Média · 6.7
CWE-625 05/03/2026
Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
Permissive regular expression in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
CVE-2026-21536
Crítica · 9.8
CWE-434 05/03/2026
Microsoft Devices Pricing Program Remote Code Execution Vulnerability
Microsoft Devices Pricing Program Remote Code Execution Vulnerability
CVE-2026-2636
Média · 5.5
CWE-159 25/02/2026
Denial of Service in Microsoft OS
This vulnerability is caused by a CWE‑159: "Improper Handling of Invalid Use of Special Elements" weakness, which leads to an unrecoverable inconsistency in the CLFS.sys driver. This condition forces a call to the KeBugCheckEx function, allowing an unprivileged user to trigger a system crash. Microsoft silently fixed this vulnerability in the September 2025 cumulative update for Windows 11 2024 LTSC and Windows Server 2025. Windows 25H2 (released in September) was released with the patch. Windows 1123h2 and earlier versions remain vulnerable.
CVE-2026-21535
Alta · 7.5
CWE-284 19/02/2026
Microsoft Teams Information Disclosure Vulnerability
Improper access control in Microsoft Teams allows an unauthorized attacker to disclose information over a network.
CVE-2026-26030
Crítica · 9.9
CWE-94 19/02/2026
Vulnerabilidade de execução remota de código no filtro InMemoryVectorStore do Microsoft Semantic Kernel
O Semantic Kernel, o SDK Python de kernel semântico da Microsoft, possui uma vulnerabilidade de execução remota de código em versões anteriores à 1.39.4, especificamente na funcionalidade de filtro do `InMemoryVectorStore`. O problema foi corrigido na versão 1.39.4. Os usuários devem atualizar para esta versão ou superior. Como solução alternativa, evite usar o `InMemoryVectorStore` em cenários de produção.
CVE-2026-26119
Alta · 8.8
CWE-287 17/02/2026
Windows Admin Center Elevation of Privilege Vulnerability
Improper authentication in Windows Admin Center allows an authorized attacker to elevate privileges over a network.
CVE-2026-0102
Baixa · 3.1
CWE-359 17/02/2026
Microsoft Edge (Chromium-based) Defense in Depth Vulnerability
Under specific conditions, a malicious webpage may trigger autofill population after two consecutive taps, potentially without clear or intentional user consent. This could result in disclosure of stored autofill data such as addresses, email, or phone number metadata.
CVE-2026-23655
Média · 6.5
CWE-312 10/02/2026
Microsoft ACI Confidential Containers Information Disclosure Vulnerability
Cleartext storage of sensitive information in Azure Compute Gallery allows an authorized attacker to disclose information over a network.
CVE-2026-21537
Alta · 8.8
CWE-94 10/02/2026
Microsoft Defender for Endpoint Linux Extension Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Defender for Linux allows an unauthorized attacker to execute code over an adjacent network.
CVE-2026-21531
Crítica · 9.8
CWE-502 10/02/2026
Azure SDK for Python Remote Code Execution Vulnerability
Deserialization of untrusted data in Azure SDK allows an unauthorized attacker to execute code over a network.
CVE-2026-21529
Média · 5.4
CWE-79 10/02/2026
Azure HDInsight Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Azure HDInsights allows an authorized attacker to perform spoofing over a network.
CVE-2026-21528
Média · 6.5
CWE-668 10/02/2026
Azure IoT Explorer Information Disclosure Vulnerability
Binding to an unrestricted ip address in Azure IoT Explorer allows an unauthorized attacker to disclose information over a network.
CVE-2026-21527
Média · 6.5
CWE-345 10/02/2026
Microsoft Exchange Server Spoofing Vulnerability
User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-21533
Alta · 7.8
KEV Alta · 61 Exploit público CWE-269 10/02/2026
Microsoft Windows Improper Privilege Management Vulnerability
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
CVE-2026-21523
Alta · 8.0
CWE-367 10/02/2026
GitHub Copilot and Visual Studio Code Remote Code Execution Vulnerability
Time-of-check time-of-use (toctou) race condition in GitHub Copilot and Visual Studio allows an authorized attacker to execute code over a network.
CVE-2026-21522
Média · 6.7
CWE-77 10/02/2026
Microsoft ACI Confidential Containers Elevation of Privilege Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Compute Gallery allows an authorized attacker to elevate privileges locally.
CVE-2026-21518
Alta · 8.8
CWE-77 10/02/2026
GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability
Improper neutralization of special elements used in a command ('command injection') in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to bypass a security feature over a network.
CVE-2026-21517
Alta · 7.0
CWE-59 10/02/2026
Windows App for Mac Installer Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in Windows App for Mac allows an authorized attacker to elevate privileges locally.
CVE-2026-21519
Alta · 7.8
KEV Alta · 54 CWE-843 10/02/2026
Microsoft Windows Type Confusion Vulnerability
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-21525
Média · 6.2
KEV Alta · 52 CWE-476 10/02/2026
Microsoft Windows NULL Pointer Dereference Vulnerability
Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
CVE-2026-21516
Alta · 7.8
CWE-77 10/02/2026
GitHub Copilot for Jetbrains Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Github Copilot allows an unauthorized attacker to execute code over a network.