Skip to content
OpenAdvisories

Source

Microsoft Security Response Center

Source: https://msrc.microsoft.com/update-guide/

All Critical High Medium Low With exploited CVEs

1,056 results · Clear filters · Feed

  • Critical max 8.2
    MSRC-CVE-2026-21532 1 CVE

    Azure Function Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.3
    MSRC-CVE-2026-21264 1 CVE

    Microsoft Account Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 7.4
    MSRC-CVE-2026-21521 1 CVE

    Word Copilot Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 8.2
    MSRC-CVE-2026-21227 1 CVE

    Azure Logic Apps Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.3
    MSRC-CVE-2026-24307 1 CVE

    M365 Copilot Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.3
    MSRC-CVE-2026-24305 1 CVE

    Azure Entra ID Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 7.4
    MSRC-CVE-2026-21524 1 CVE

    Azure Data Explorer Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.8
    MSRC-CVE-2026-24306 1 CVE

    Azure Front Door Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 7.5
    MSRC-CVE-2026-21520 1 CVE

    Copilot Studio Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 7.8
    MSRC-CVE-2026-20957 1 CVE

    Microsoft Excel Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 8.4
    MSRC-CVE-2026-20952 1 CVE

    Microsoft Office Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 7.5
    MSRC-CVE-2026-20854 1 CVE

    Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 7.8
    MSRC-CVE-2026-20955 1 CVE

    Microsoft Excel Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 8.4
    MSRC-CVE-2026-20953 1 CVE

    Microsoft Office Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 8.4
    MSRC-CVE-2026-20944 1 CVE

    Microsoft Word Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 6.7
    MSRC-CVE-2026-20876 1 CVE

    Windows Virtualization-Based Security (VBS) Enclave Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 7.8
    MSRC-CVE-2026-20822 1 CVE

    Windows Graphics Component Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 8.2
    MSRC-CVE-2025-64677 1 CVE

    Office Out-of-Box Experience Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Dec 9, 2025
  • Critical max 8.3
    MSRC-CVE-2025-64675 1 CVE

    Azure Cosmos DB Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Dec 9, 2025
  • Critical max 7.2
    MSRC-CVE-2025-64676 1 CVE

    Microsoft Purview eDiscovery Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Dec 9, 2025
  • Critical max 10.0
    MSRC-CVE-2025-65037 1 CVE

    Azure Container Apps Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Dec 9, 2025
  • Critical max 10.0
    MSRC-CVE-2025-65041 1 CVE

    Microsoft Partner Center Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Dec 9, 2025
  • Critical max 9.9
    MSRC-CVE-2025-64663 1 CVE

    Custom Question Answering Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Dec 9, 2025
  • Critical max 8.4
    MSRC-CVE-2025-62557 1 CVE rev. 2

    Microsoft Office Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
    first Dec 9, 2025
  • Critical max 8.4
    MSRC-CVE-2025-62554 1 CVE rev. 2

    Microsoft Office Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
    first Dec 9, 2025
  • Critical max 9.3
    MSRC-CVE-2025-59286 1 CVE rev. 2

    Microsoft Copilot Information Disclosure Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Not required.

    Microsoft
    first Oct 9, 2025
  • Critical max 9.3
    MSRC-CVE-2025-59272 1 CVE rev. 2

    Microsoft Copilot Information Disclosure Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Not required.

    Microsoft
    first Oct 9, 2025
  • Critical max 9.3
    MSRC-CVE-2025-59252 1 CVE rev. 2

    M365 Copilot Information Disclosure Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Not required.

    Microsoft
    first Oct 9, 2025
  • Critical max 10.0
    MSRC-CVE-2025-49752 1 CVE rev. 3

    Azure Bastion Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Nov 11, 2025
  • Critical max 9.8
    MSRC-CVE-2025-64657 1 CVE

    Azure Application Gateway Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Nov 11, 2025
  • Critical max 8.3
    MSRC-CVE-2025-62459 1 CVE

    Microsoft Defender Portal Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Nov 11, 2025
  • Critical max 8.6
    MSRC-CVE-2025-62207 1 CVE

    Azure Monitor Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Nov 11, 2025
  • Critical max 9.8
    MSRC-CVE-2025-59245 1 CVE

    Microsoft SharePoint Online Elevation of Privilege Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Nov 11, 2025
  • Critical max 8.8
    MSRC-CVE-2025-64655 1 CVE

    Dynamics OmniChannel SDK Storage Containers Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation More Likely. Customer action: Not required.

    Microsoft
    first Nov 11, 2025
  • Critical max 9.4
    MSRC-CVE-2025-64656 1 CVE

    Azure Application Gateway Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
    first Nov 11, 2025
  • Critical max 8.1
    MSRC-CVE-2025-30398 1 CVE

    Nuance PowerScribe 360 Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 6.7
    MSRC-CVE-2025-62214 1 CVE

    Visual Studio Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 9.8
    MSRC-CVE-2025-60724 1 CVE

    GDI+ Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 7.0
    MSRC-CVE-2025-60716 1 CVE

    DirectX Graphics Kernel Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 7.8
    MSRC-CVE-2025-62199 1 CVE

    Microsoft Office Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft