microsoft has 4,534 CVEs on record between 2012 and 2026. Disclosure cadence is accelerating: 2942 in the last 90 days against 900 in the 90 before. The busiest recent month was October 2026 with 1462. The median CVSS is 7.8 (high), with 269 rated critical. 2% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 112 days (95 cases). The dominant weakness classes are CWE-122 (924) and CWE-416 (846). Most affected products: Windows 10 Version 1607 (1063), windows_10_1607 (805), 365_apps (265).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 2% vs 1% corpus
- Median CVSS
- 7.8
- Publish → KEV
- 112 d median(95)
- Last 90 days
- 2942 prev 900
Weakness classes
Products
- Windows 10 Version 1607 1063
- windows_10_1607 805
- 365_apps 265
- Windows 10 Version 1809 237
- Microsoft 365 Apps for Enterprise 233
- Windows 11 Version 24H2 137
Worst active — by depth score
CVE-2025-53770Critical· 9.8Deserialization of untrusted data in on-premises Microsoft SharePoint Server allows an unauthorized attacker to execute code over a network. Microsoft is aware that an exploit for CVE-2025-53770 exists in the wild. Microsoft is preparing…100CVE-2021-38647Critical· 9.8Open Management Infrastructure (OMI) Remote Code Execution Vulnerability100CVE-2021-34473Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability100CVE-2021-26855Critical· 9.1Microsoft Exchange Server Remote Code Execution Vulnerability100CVE-2020-0796Critical· 10.0A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution Vulnerability'.100
microsoft vulnerabilities
CVEs affecting microsoft, newest first. Open any entry for full detail, references, and exploit status.
4534 CVEsRSS
CVE-2026-83938Critical· 10.0Azure Kubernetes Configuration Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Azure Kubernetes Configuration Service allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-110063Critical· 10.0VM Inspector for Azure Virtual Machines Elevation of Privilege Vulnerability
Improper link resolution before file access ('link following') in VM Inspector for Azure Virtual Machines allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-97785Critical· 10.0AAD App Proxy Elevation of Privilege Vulnerability
Improper authentication in AAD App Proxy allows an unauthorized attacker to elevate privileges over a network.
CVE-2026-96185High· 7.5Microsoft Exchange Online Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
CVE-2026-108456High· 7.7Azure AI Foundry Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Azure AI Foundry allows an authorized attacker to elevate privileges over a network.
CVE-2026-105014Critical· 9.1Azure Pipelines Remote Code Execution Vulnerability
Improper neutralization of special elements used in a command ('command injection') in Azure Pipelines allows an unauthorized attacker to execute code over a network.
CVE-2026-80092Medium· 5.3Microsoft Identity Web Elevation of Privilege Vulnerability
Authentication bypass by assumed-immutable data in Microsoft Identity Web allows an authorized attacker to elevate privileges over a network.
CVE-2026-109461Medium· 5.9Microsoft Authentication Library (MSAL) for Node.js Information Disclosure Vulnerability
Origin validation error in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to disclose information over a network.
CVE-2026-108429High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108428High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108427High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108426High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108432High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108431High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108430High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108435Medium· 6.5Microsoft Office Word Information Disclosure Vulnerability
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-108434Medium· 6.5Microsoft Office Word Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-108433High· 7.8Microsoft Office Word Security Feature Bypass Vulnerability
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
CVE-2026-108438Medium· 6.5Microsoft Office Word Information Disclosure Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-108437High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108436Medium· 6.5Microsoft Office Word Information Disclosure Vulnerability
Out-of-bounds read in Microsoft Office Word allows an unauthorized attacker to disclose information over a network.
CVE-2026-108441High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108440High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108439High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108445High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108444High· 8.8Microsoft Office Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code over a network.
CVE-2026-108443High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Off-by-one error in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108442High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code over a network.
CVE-2026-108448High· 7.5Microsoft Office Outlook Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Outlook allows an unauthorized attacker to execute code over a network.
CVE-2026-108447High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Office Word allows an unauthorized attacker to execute code over a network.