[ Vendor · 1,865 CVEs ]
Microsoft
CVEs affecting Microsoft published in the last 30 days, plus any Microsoft CVE on CISA's exploited list.
| CVE | Published | Severity | Vulnerability | Signals |
|---|---|---|---|---|
| CVE-2026-88124 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88125 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows Server 2012Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network. | |
| CVE-2026-88126 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88127 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows SMB Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88128 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88117 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows Server 2012Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88118 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88119 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows Server 2012Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88120 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows Server 2012Use after free in Windows DHCP Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88121 | 13 Oct 2026 | CVSS 8.0 | Microsoft Windows 10 Version 1607Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88122 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows Server 2012Out-of-bounds read in DNS Server allows an authorized attacker to deny service over a network. | |
| CVE-2026-88110 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Heap-based buffer overflow in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88112 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88113 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88114 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88115 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Server for NFS allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88116 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-88101 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88102 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows Server 2019Use after free in Windows Failover Cluster allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-88103 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88105 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Broadcast DVR User Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88106 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88107 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88109 | 13 Oct 2026 | CVSS 7.8 | Microsoft 365 Apps for EnterpriseUse after free in Microsoft Office Click-To-Run allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-88092 | 13 Oct 2026 | CVSS 9.4 | Microsoft Security Advisory CVE-2026-88092 - ASP.NET Core Security Feature BypassInconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an unauthorized attacker to perform tampering… | Fix |
| CVE-2026-88093 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88094 | 13 Oct 2026 | CVSS 8.1 | Microsoft azure-storage-blob-batchImproper neutralization of special elements in output used by a downstream component ('injection') in Azure Storage Library allows an authorized… | Fix |
| CVE-2026-88096 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to… | Fix |
| CVE-2026-88098 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in Windows Security Support Provider Interface allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88099 | 13 Oct 2026 | CVSS 5.9 | Microsoft Windows Server 2019Uncaught exception in Windows Failover Cluster allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-88100 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Use after free in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88073 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88074 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88075 | 13 Oct 2026 | CVSS 8.8 | Microsoft Configuration ManagerImproper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker… | Fix |
| CVE-2026-88076 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Null pointer dereference in Windows Installer allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88079 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 11 Version 24H2Null pointer dereference in Windows MIDI Service Module allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88080 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88091 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-87714 | 13 Oct 2026 | CVSS 6.5 | Microsoft Windows 10 Version 1607Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network. | Fix |
| CVE-2026-87715 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-87716 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network. | Fix |
| CVE-2026-88070 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88071 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-88072 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-87709 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally. | |
| CVE-2026-87710 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-87711 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-87712 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally. | Fix |
| CVE-2026-87713 | 13 Oct 2026 | CVSS 7.5 | Microsoft Windows 10 Version 1607Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network. | Fix |
| CVE-2026-87702 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87704 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87705 | 13 Oct 2026 | CVSS 7.4 | Microsoft Windows 10 Version 1607Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an… | |
| CVE-2026-87706 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87707 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87708 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87695 | 13 Oct 2026 | CVSS 7.8 | Microsoft Exchange Server 2016 Cumulative Update 23Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87696 | 13 Oct 2026 | CVSS 7.5 | Microsoft Exchange Server 2016 Cumulative Update 23Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-87697 | 13 Oct 2026 | CVSS 8.8 | Microsoft Security Advisory CVE-2026-87697 - .NET and Visual Studio Remote Code ExecutionDeserialization of untrusted data in .NET allows an unauthorized attacker to execute code over a network. | Fix |
| CVE-2026-87698 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Remote Access Service Infrastructure allows an authorized attacker to disclose information locally. | |
| CVE-2026-87699 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87700 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85943 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges… | |
| CVE-2026-85945 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87691 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 version 23H2Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87692 | 13 Oct 2026 | CVSS 7.8 | Microsoft Exchange Server 2016 Cumulative Update 23Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87693 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-87694 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Installer allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85935 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Buffer over-read in Windows USB Driver allows an authorized attacker to disclose information locally. | |
| CVE-2026-85936 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Double free in Windows Shell allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-85938 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1809Improper access control in Windows Broadcast DVR User Service allows an authorized attacker to disclose information locally. | |
| CVE-2026-85939 | 13 Oct 2026 | CVSS 5.3 | Microsoft Windows 10 Version 1607Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network. | |
| CVE-2026-85941 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to… | |
| CVE-2026-85930 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 21H2Use after free in Windows Image Acquisition allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85931 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network. | |
| CVE-2026-85932 | 13 Oct 2026 | CVSS 6.5 | Microsoft SharePoint Server Subscription EditionImproper limitation of a pathname to a restricted directory ('path traversal') in Microsoft Office SharePoint allows an authorized attacker to… | Fix |
| CVE-2026-85933 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Use after free in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85934 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1809Use after free in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85920 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Time-of-check time-of-use (toctou) race condition in Windows BitLocker allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85922 | 13 Oct 2026 | CVSS 7.4 | Microsoft azure_security_keyvault_certificatesWeak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network. | Fix |
| CVE-2026-85925 | 13 Oct 2026 | CVSS 8.2 | Microsoft azure-keyvault-administrationImproper restriction of communication channel to intended endpoints in Azure Key Vault allows an authorized attacker to elevate privileges over a… | Fix |
| CVE-2026-85926 | 13 Oct 2026 | CVSS 8.1 | Microsoft Windows 10 Version 1607Use after free in Windows Secure Socket Tunneling Protocol (SSTP) allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-85927 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85928 | 13 Oct 2026 | CVSS 9.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Volume Manager Extension Driver allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-85910 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 Version 24H2Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally. | |
| CVE-2026-85911 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Use after free in Windows StateRepository API allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85912 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized… | |
| CVE-2026-85914 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85915 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1809Heap-based buffer overflow in Windows PCI Bus Driver allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85916 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 11 version 23H2Exposure of private personal information to an unauthorized actor in Azure Active Directory allows an unauthorized attacker to disclose information… | |
| CVE-2026-85918 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85903 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Untrusted pointer dereference in DNS Server allows an unauthorized attacker to execute code over a network. | |
| CVE-2026-85904 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows 10 Version 1607Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an… | Fix |
| CVE-2026-85905 | 13 Oct 2026 | CVSS 8.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85906 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 21H2Use after free in Windows Direct Composition allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85908 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 10 Version 1607Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85909 | 13 Oct 2026 | CVSS 5.5 | Microsoft Windows 10 Version 1607Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally. | |
| CVE-2026-85879 | 13 Oct 2026 | CVSS 7.0 | Microsoft Windows Subsystem for Linux (WSL2)Time-of-check time-of-use (toctou) race condition in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally. | |
| CVE-2026-85881 | 13 Oct 2026 | CVSS 8.0 | Microsoft Office for AndroidStack-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges over a network. | |
| CVE-2026-85884 | 13 Oct 2026 | CVSS 7.8 | Microsoft Windows 11 Version 24H2Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges… | |
| CVE-2026-85891 | 13 Oct 2026 | CVSS 7.5 | Microsoft Azure HDInsightExposure of sensitive information to an unauthorized actor in Azure HDInsight allows an unauthorized attacker to disclose information over a network. | Fix |
Page 5 of 19