Skip to content
OpenAdvisories

Source

Microsoft Security Response Center

Source: https://msrc.microsoft.com/update-guide/

All Critical High Medium Low With exploited CVEs

1,056 results · Clear filters · Feed

  • Critical max 8.8
    MSRC-CVE-2026-35430 1 CVE

    Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 10.0
    MSRC-CVE-2026-23652 1 CVE

    Microsoft Power Pages Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 10.0
    MSRC-CVE-2026-40412 1 CVE

    Azure Orbital Spatio Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 8.4
    MSRC-CVE-2026-40367 1 CVE rev. 3

    Microsoft Word Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
    first May 12, 2026
  • Critical max 10.0
    MSRC-CVE-2026-42822 1 CVE

    Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.

    Microsoft
  • Critical max 9.3
    MSRC-CVE-2026-40379 1 CVE rev. 2

    Azure Entra ID Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first May 7, 2026
  • Critical max 7.5
    MSRC-CVE-2026-32161 1 CVE rev. 2

    Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
    first May 12, 2026
  • Critical max 9.6
    MSRC-CVE-2026-41615 1 CVE

    Microsoft Authenticator Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 9.1
    MSRC-CVE-2026-41103 1 CVE

    Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.

    Microsoft
  • Critical max 8.8
    MSRC-CVE-2026-40403 1 CVE

    Windows Graphics Component Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 9.3
    MSRC-CVE-2026-40402 1 CVE

    Windows Hyper-V Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 8.8
    MSRC-CVE-2026-40365 1 CVE

    Microsoft SharePoint Server Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 8.4
    MSRC-CVE-2026-40358 1 CVE

    Microsoft Office Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 7.8
    MSRC-CVE-2026-42831 1 CVE

    Microsoft Office Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
  • Critical max 9.8
    MSRC-CVE-2026-41096 1 CVE

    Windows DNS Client Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
  • Critical max 9.8
    MSRC-CVE-2026-41089 1 CVE

    Windows Netlogon Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 8.4
    MSRC-CVE-2026-40366 1 CVE

    Microsoft Word Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 8.4
    MSRC-CVE-2026-40364 1 CVE

    Microsoft Word Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Required.

    Microsoft
  • Critical max 8.4
    MSRC-CVE-2026-40363 1 CVE

    Microsoft Office Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 7.8
    MSRC-CVE-2026-35421 1 CVE

    Windows GDI Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
  • Critical max 7.7
    MSRC-CVE-2026-33821 1 CVE

    Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 10.0
    MSRC-CVE-2026-42826 1 CVE

    Azure DevOps Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.6
    MSRC-CVE-2026-35428 1 CVE

    Azure Cloud Shell Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 8.6
    MSRC-CVE-2026-35435 1 CVE

    Azure AI Foundry Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Not required.

    Microsoft
  • Critical max 8.2
    MSRC-CVE-2026-34327 1 CVE

    Microsoft Partner Center Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.0
    MSRC-CVE-2026-33844 1 CVE

    Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.6
    MSRC-CVE-2026-33823 1 CVE

    Microsoft Team Events Portal Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 8.8
    MSRC-CVE-2026-32207 1 CVE

    Azure Machine Learning Notebook Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.9
    MSRC-CVE-2026-33109 1 CVE

    Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 7.5
    MSRC-CVE-2026-33111 1 CVE

    Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Not required.

    Microsoft
  • Critical max 8.1
    MSRC-CVE-2026-41105 1 CVE

    Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 7.5
    MSRC-CVE-2026-26129 1 CVE

    M365 Copilot Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 7.5
    MSRC-CVE-2026-26164 1 CVE

    M365 Copilot Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Not required.

    Microsoft
  • Critical max 9.9
    MSRC-CVE-2026-21515 1 CVE

    Azure IoT Central Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 8.0
    MSRC-CVE-2026-32172 1 CVE

    Microsoft Power Apps Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 10.0
    MSRC-CVE-2026-35431 1 CVE

    Microsoft Entra ID Entitlement Management Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.6
    MSRC-CVE-2026-24303 1 CVE

    Microsoft Partner Center Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 8.6
    MSRC-CVE-2026-26150 1 CVE

    Microsoft Purview eDiscovery Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 10.0
    MSRC-CVE-2026-33819 1 CVE

    Microsoft Bing Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.3
    MSRC-CVE-2026-33102 1 CVE

    Microsoft 365 Copilot Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft