Microsoft has 4,599 CVEs on record between 2012 and 2026. Disclosure cadence is accelerating: 2930 in the last 90 days against 932 in the 90 before. The busiest recent month was October 2026 with 1482. The median CVSS is 7.8 (high), with 273 rated critical. 2% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 112 days (95 cases). The dominant weakness classes are CWE-122 (931) and CWE-416 (851). Most affected products: windows_10_1607 (988), Windows 10 Version 1607 (877), 365_apps (267).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 2% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- 112 d median(95)
- Last 90 days
- 2930 prev 932
Weakness classes
Products
- windows_10_1607 988
- Windows 10 Version 1607 877
- 365_apps 267
- Microsoft 365 Apps for Enterprise 232
- Windows 10 Version 1809 199
- windows_10_1809 174
Worst active — by depth score
CVE-2025-53770Critical· 9.8Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing…100CVE-2021-38647Critical· 9.8Open Management Infrastructure (OMI) Remote Code Execution Vulnerability100CVE-2021-34473Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability100CVE-2021-26855Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability100CVE-2020-0796Critical· 10.0A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.100
Microsoft vulnerabilities
CVEs affecting Microsoft, newest first. Open any entry for full detail, references, and exploit status.
4599 CVEsRSS
CVE-2024-30067Medium· 5.5Winlogon Elevation of Privilege Vulnerability
Winlogon Elevation of Privilege Vulnerability
CVE-2024-30066Medium· 5.5Winlogon Elevation of Privilege Vulnerability
Winlogon Elevation of Privilege Vulnerability
CVE-2024-30065Medium· 5.5Windows Themes Denial of Service Vulnerability
Windows Themes Denial of Service Vulnerability
CVE-2024-30063Medium· 6.7Windows Distributed File System (DFS) Remote Code Execution Vulnerability
Windows Distributed File System (DFS) Remote Code Execution Vulnerability
CVE-2024-30062High· 7.8Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability
Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability
CVE-2024-30052Medium· 4.7PoCVisual Studio Remote Code Execution Vulnerability
Visual Studio Remote Code Execution Vulnerability
CVE-2024-29060Medium· 6.7Visual Studio Elevation of Privilege Vulnerability
Visual Studio Elevation of Privilege Vulnerability
CVE-2024-30040High· 8.8CISA KEV0dayPoCWindows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
CVE-2024-26230High· 7.8PoCWindows Telephony Server Elevation of Privilege Vulnerability
Windows Telephony Server Elevation of Privilege Vulnerability
CVE-2024-29992Medium· 5.5Azure Identity Library for .NET Information Disclosure Vulnerability
Azure Identity Library for .NET Information Disclosure Vulnerability
CVE-2024-21400Critical· 9.0Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
CVE-2024-21338High· 7.8CISA KEV0dayPoCWindows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
CVE-2023-36009Medium· 5.5Microsoft Word Information Disclosure Vulnerability
Microsoft Word Information Disclosure Vulnerability
CVE-2023-35636Medium· 6.5PoCMicrosoft Outlook Information Disclosure Vulnerability
Microsoft Outlook Information Disclosure Vulnerability
CVE-2023-36049High· 7.6.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
.NET, .NET Framework, and Visual Studio Elevation of Privilege Vulnerability
CVE-2023-29348High· 7.5Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability
Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability
CVE-2023-36566Medium· 6.5Microsoft Common Data Model SDK Denial of Service Vulnerability
Microsoft Common Data Model SDK Denial of Service Vulnerability
CVE-2023-35311High· 8.8CISA KEV0dayPoCMicrosoft Outlook Security Feature Bypass Vulnerability
Microsoft Outlook Security Feature Bypass Vulnerability
CVE-2023-32028High· 7.8Microsoft SQL OLE DB Remote Code Execution Vulnerability
Microsoft SQL OLE DB Remote Code Execution Vulnerability
CVE-2023-23384High· 7.3Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2023-24908High· 8.1Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
CVE-2023-21713High· 8.8Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2023-21705High· 8.8Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2023-21704High· 7.8Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
Microsoft ODBC Driver for SQL Server Remote Code Execution Vulnerability
CVE-2023-21568High· 7.3Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability
Microsoft SQL Server Integration Service (VS extension) Remote Code Execution Vulnerability
CVE-2023-21528High· 7.8Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server Remote Code Execution Vulnerability
CVE-2023-23376High· 7.8CISA KEV0dayWindows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2023-21748High· 7.8PoCWindows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability
CVE-2022-41083High· 7.8Visual Studio Code Elevation of Privilege Vulnerability
Visual Studio Code Elevation of Privilege Vulnerability
CVE-2022-41042High· 7.4Visual Studio Code Information Disclosure Vulnerability
Visual Studio Code Information Disclosure Vulnerability