Skip to content
OpenAdvisories

Source

Microsoft Security Response Center

Source: https://msrc.microsoft.com/update-guide/

All Critical High Medium Low With exploited CVEs

10,146 results · Feed

  • High max 5.5
    MSRC-CVE-2026-20805 1 CVE 1 exploited rev. 4

    Desktop Window Manager Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Important. Exploited according to Microsoft — Exploitation Detected. Customer action: Required.

    Microsoft
    first Jan 13, 2026
  • Critical max 9.3
    MSRC-CVE-2026-21264 1 CVE

    Microsoft Account Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 7.4
    MSRC-CVE-2026-21521 1 CVE

    Word Copilot Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 8.2
    MSRC-CVE-2026-21227 1 CVE

    Azure Logic Apps Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.3
    MSRC-CVE-2026-24307 1 CVE

    M365 Copilot Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.3
    MSRC-CVE-2026-24305 1 CVE

    Azure Entra ID Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 7.4
    MSRC-CVE-2026-21524 1 CVE

    Azure Data Explorer Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 9.8
    MSRC-CVE-2026-24306 1 CVE

    Azure Front Door Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • Critical max 7.5
    MSRC-CVE-2026-21520 1 CVE

    Copilot Studio Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Critical. Not known to be exploited. Customer action: Not required.

    Microsoft
  • High max 7.5
    MSRC-CVE-2026-20848 1 CVE rev. 2

    Windows SMB Server Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
    first Jan 13, 2026
  • High max 7.0
    MSRC-CVE-2026-20830 1 CVE rev. 2

    Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
    first Jan 13, 2026
  • High max 6.2
    MSRC-CVE-2026-20818 1 CVE rev. 2

    Windows Kernel Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
    first Jan 13, 2026
  • High max 7.0
    MSRC-CVE-2026-20943 1 CVE rev. 3

    Microsoft Office Click-To-Run Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
    first Jan 13, 2026
  • High max 7.0
    MSRC-CVE-2026-21221 1 CVE rev. 2

    Capability Access Management Service (camsvc) Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
    first Jan 13, 2026
  • High max 8.1
    MSRC-CVE-2026-20856 1 CVE rev. 2

    Windows Server Update Service (WSUS) Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
    first Jan 13, 2026
  • High max 5.4
    MSRC-CVE-2026-20958 1 CVE rev. 2

    Microsoft SharePoint Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
    first Jan 13, 2026
  • High max 7.8
    MSRC-CVE-2025-64679 1 CVE rev. 2

    Windows DWM Core Library Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
    first Dec 9, 2025
  • High max 8.8
    MSRC-CVE-2025-64678 1 CVE rev. 2

    Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
    first Dec 9, 2025
  • High max 7.5
    MSRC-CVE-2026-21226 1 CVE

    Azure Core shared client library for Python Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 7.8
    MSRC-CVE-2026-20941 1 CVE

    Host Process for Windows Tasks Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 7.8
    MSRC-CVE-2026-20957 1 CVE

    Microsoft Excel Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • Critical max 8.4
    MSRC-CVE-2026-20952 1 CVE

    Microsoft Office Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 7.8
    MSRC-CVE-2026-20950 1 CVE

    Microsoft Excel Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 7.8
    MSRC-CVE-2026-20949 1 CVE

    Microsoft Excel Security Feature Bypass Vulnerability

    Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 7.8
    MSRC-CVE-2026-20948 1 CVE

    Microsoft Word Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 5.5
    MSRC-CVE-2026-20939 1 CVE

    Windows File Explorer Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
  • High max 5.5
    MSRC-CVE-2026-20937 1 CVE

    Windows File Explorer Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
  • High max 4.3
    MSRC-CVE-2026-20936 1 CVE

    Windows NDIS Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
  • High max 6.2
    MSRC-CVE-2026-20935 1 CVE

    Windows Virtualization-Based Security (VBS) Information Disclosure Vulnerability

    Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 8.0
    MSRC-CVE-2026-20931 1 CVE

    Windows Telephony Service Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
  • High max 7.5
    MSRC-CVE-2026-20929 1 CVE

    Windows HTTP.sys Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
  • High max 7.8
    MSRC-CVE-2026-20874 1 CVE

    Windows Management Services Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 7.8
    MSRC-CVE-2026-20873 1 CVE

    Windows Management Services Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 6.5
    MSRC-CVE-2026-20872 1 CVE

    NTLM Hash Disclosure Spoofing Vulnerability

    Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 7.8
    MSRC-CVE-2026-20871 1 CVE

    Desktop Window Manager Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.

    Microsoft
  • High max 7.8
    MSRC-CVE-2026-20870 1 CVE

    Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 8.8
    MSRC-CVE-2026-20868 1 CVE

    Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

    Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 7.8
    MSRC-CVE-2026-20867 1 CVE

    Windows Management Services Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Unlikely. Customer action: Required.

    Microsoft
  • High max 7.8
    MSRC-CVE-2026-20866 1 CVE

    Windows Management Services Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft
  • High max 7.0
    MSRC-CVE-2026-20863 1 CVE

    Win32k Elevation of Privilege Vulnerability

    Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

    Microsoft