Vendor
Microsoft, page 4
As of , 389 Microsoft vulnerabilities are on CISA's list of exploited vulnerabilities, 117 of them used in ransomware campaigns; 40 were added in 2026. Patch first: CVE-2019-1068.
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 226 | CVE-2019-0859Privilege Escalation | Microsoft Win32k | Patch this weekRansomware use | 0.04 | ||
| 227 | CVE-2021-36955Common Log File System (CLFS) Driver Privilege Escalation | Microsoft Windows | Patch this weekRansomware use | 0.04 | ||
| 228 | CVE-2019-1385AppX Deployment Extensions Privilege Escalation | Microsoft Windows | Patch this weekRansomware use | 0.04 | ||
| 229 | CVE-2018-8405DirectX Graphics Kernel Privilege Escalation | Microsoft DirectX Graphics Kernel (DXGKRNL) | Patch this weekRansomware use | 0.03 | ||
| 230 | CVE-2018-8406DirectX Graphics Kernel Privilege Escalation | Microsoft DirectX Graphics Kernel (DXGKRNL) | Patch this weekRansomware use | 0.03 | ||
| 231 | CVE-2019-1315Error Reporting Manager Privilege Escalation | Microsoft Windows | Patch this weekRansomware use | 0.03 | ||
| 232 | CVE-2021-43226Privilege Escalation | Microsoft Windows | Patch this weekRansomware use | 0.03 | ||
| 233 | CVE-2020-0878Memory Corruption | Microsoft Edge and Internet Explorer | Patch this weekRansomware use | 0.03 | ||
| 234 | CVE-2020-0638Privilege Escalation | Microsoft Update Notification Manager | Patch this weekRansomware use | 0.02 | ||
| 235 | CVE-2022-41073Print Spooler Privilege Escalation | Microsoft Windows | Patch this weekRansomware use | 0.02 | ||
| 236 | CVE-2022-41091Mark of the Web (MOTW) Security Feature Bypass | Microsoft Windows | Patch this weekRansomware use | 0.02 | ||
| 237 | CVE-2019-1129AppX Deployment Service (AppXSVC) Privilege Escalation | Microsoft Windows | Patch this weekRansomware use | 0.02 | ||
| 238 | CVE-2019-1130AppX Deployment Service Privilege Escalation | Microsoft Windows | Patch this weekRansomware use | 0.02 | ||
| 239 | CVE-2010-4398Kernel Stack-Based Buffer Overflow | Microsoft Windows | Patch soonVerified Exploit-DB entry | 0.09 | ||
| 240 | CVE-2004-0210Privilege Escalation | Microsoft Windows | Patch soonVerified Exploit-DB entry | 0.07 | ||
| 241 | CVE-2002-0367Privilege Escalation | Microsoft Windows | Patch soonVerified Exploit-DB entry | 0.05 | ||
| 242 | CVE-2009-0238Remote Code Execution | Microsoft Office | Patch soon | 0.43 | ||
| 243 | CVE-2026-32201Improper Input Validation | Microsoft SharePoint Server | Patch soon | 0.43 | ||
| 244 | CVE-2026-20963Deserialization of Untrusted Data | Microsoft SharePoint | Patch soon | 0.30 | ||
| 245 | CVE-2007-0671Excel Remote Code Execution | Microsoft Office | Patch soon | 0.43 | ||
| 246 | CVE-2024-43573MSHTML Platform Spoofing | Microsoft Windows | Patch soon | 0.46 | ||
| 247 | CVE-2024-38178Scripting Engine Memory Corruption | Microsoft Windows | Patch soon | 0.41 | ||
| 248 | CVE-2024-38193Ancillary Function Driver for WinSock Privilege Escalation | Microsoft Windows | Patch soon | 0.29 | ||
| 249 | CVE-2024-29988Security Feature Bypass | Microsoft SmartScreen Prompt | Patch soon | 0.45 | ||
| 250 | CVE-2024-21351SmartScreen Security Feature Bypass | Microsoft Windows | Patch soon | 0.28 | ||
| 251 | CVE-2023-36802Privilege Escalation | Microsoft Streaming Service Proxy | Patch soon | 0.28 | ||
| 252 | CVE-2023-29336Privilege Escalation | Microsoft Win32k | Patch soon | 0.41 | ||
| 253 | CVE-2023-21674Advanced Local Procedure Call (ALPC) Privilege Escalation | Microsoft Windows | Patch soon | 0.41 | ||
| 254 | CVE-2006-2492Malformed Object Pointer | Microsoft Word | Patch soon | 0.48 | ||
| 255 | CVE-2014-4123Privilege Escalation | Microsoft Internet Explorer | Patch soon | 0.47 | ||
| 256 | CVE-2015-0071ASLR Bypass | Microsoft Internet Explorer | Patch soon | 0.34 | ||
| 257 | CVE-2015-1671Remote Code Execution | Microsoft Windows | Patch soon | 0.49 | ||
| 258 | CVE-2015-2425Memory Corruption | Microsoft Internet Explorer | Patch soon | 0.45 | ||
| 259 | CVE-2016-3298Messaging API Information Disclosure | Microsoft Internet Explorer | Patch soon | 0.33 | ||
| 260 | CVE-2017-0149Memory Corruption | Microsoft Internet Explorer | Patch soon | 0.29 | ||
| 261 | CVE-2015-1770Uninitialized Memory Use | Microsoft Office | Patch soon | 0.35 | ||
| 262 | CVE-2011-1889Forefront TMG Remote Code Execution | Microsoft Forefront Threat Management Gateway (TMG) | Patch soon | 0.49 | ||
| 263 | CVE-2015-2387Privilege Escalation | Microsoft ATM Font Driver | Patch soon | 0.35 | ||
| 264 | CVE-2015-2424Memory Corruption | Microsoft PowerPoint | Patch soon | 0.40 | ||
| 265 | CVE-2017-0222Remote Code Execution | Microsoft Internet Explorer | Patch soon | 0.30 | ||
| 266 | CVE-2013-3900Remote Code Execution | Microsoft WinVerifyTrust function | Patch soon | 0.45 | ||
| 267 | CVE-2021-42292Excel Security Feature Bypass | Microsoft Office | Patch soon | 0.43 | ||
| 268 | CVE-2018-8653Scripting Engine Memory Corruption | Microsoft Internet Explorer | Patch soon | 0.30 | ||
| 269 | CVE-2020-1464Spoofing | Microsoft Windows | Patch soon | 0.39 | ||
| 270 | CVE-2020-17144Remote Code Execution | Microsoft Exchange Server | Patch soon | 0.37 | ||
| 271 | CVE-2021-1647Remote Code Execution | Microsoft Defender | Patch soon | 0.39 | ||
| 272 | CVE-2021-34448Scripting Engine Memory Corruption | Microsoft Windows | Patch soon | 0.40 | ||
| 273 | CVE-2012-1854Visual Basic for Applications Insecure Library Loading | Microsoft Visual Basic for Applications (VBA) | Patch soon | 0.21 | ||
| 274 | CVE-2026-21510Shell Protection Mechanism Failure | Microsoft Windows | Patch soon | 0.24 | ||
| 275 | CVE-2025-30397Scripting Engine Type Confusion | Microsoft Windows | Patch soon | 0.27 | ||
| 276 | CVE-2024-49138Common Log File System (CLFS) Driver Heap-Based Buffer Overflow | Microsoft Windows | Patch soon | 0.26 | ||
| 277 | CVE-2023-29360Untrusted Pointer Dereference | Microsoft Streaming Service | Patch soon | 0.22 | ||
| 278 | CVE-2023-36563Information Disclosure | Microsoft WordPad | Patch soon | 0.21 | ||
| 279 | CVE-2023-36761Information Disclosure | Microsoft Word | Patch soon | 0.20 | ||
| 280 | CVE-2022-41128Scripting Languages Remote Code Execution | Microsoft Windows | Patch soon | 0.25 | ||
| 281 | CVE-2022-22047Client Server Runtime Subsystem (CSRSS) Privilege Escalation | Microsoft Windows | Patch soon | 0.19 | ||
| 282 | CVE-2014-2817Privilege Escalation | Microsoft Internet Explorer | Patch soon | 0.26 | ||
| 283 | CVE-2016-0162Information Disclosure | Microsoft Internet Explorer | Patch soon | 0.22 | ||
| 284 | CVE-2017-0022Information Disclosure | Microsoft XML Core Services | Patch soon | 0.18 | ||
| 285 | CVE-2017-0210Privilege Escalation | Microsoft Internet Explorer | Patch soon | 0.22 | ||
| 286 | CVE-2022-22718Print Spooler Privilege Escalation | Microsoft Windows | Patch soon | 0.18 | ||
| 287 | CVE-2021-34484User Profile Service Privilege Escalation | Microsoft Windows | Patch soon | 0.22 | ||
| 288 | CVE-2019-0903GDI Remote Code Execution | Microsoft Graphics Device Interface (GDI) | Patch soon | 0.22 | ||
| 289 | CVE-2019-1297Remote Code Execution | Microsoft Excel | Patch soon | 0.22 | ||
| 290 | CVE-2020-1380Scripting Engine Memory Corruption | Microsoft Internet Explorer | Patch soon | 0.24 | ||
| 291 | CVE-2021-31956NTFS Privilege Escalation | Microsoft Windows | Patch soon | 0.22 | ||
| 292 | CVE-2021-36948Update Medic Service Privilege Escalation | Microsoft Windows | Patch soon | 0.23 | ||
| 293 | CVE-2023-36424Out-of-Bounds Read | Microsoft Windows | Patch soon | 0.12 | ||
| 294 | CVE-2026-21513MSHTML Framework Protection Mechanism Failure | Microsoft Windows | Patch soon | 0.16 | ||
| 295 | CVE-2024-38213SmartScreen Security Feature Bypass | Microsoft Windows | Patch soon | 0.14 | ||
| 296 | CVE-2022-38028Print Spooler Privilege Escalation | Microsoft Windows | Patch soon | 0.15 | ||
| 297 | CVE-2024-21410Privilege Escalation | Microsoft Exchange Server | Patch soon | 0.13 | ||
| 298 | CVE-2023-36036Cloud Files Mini Filter Driver Privilege Escalation | Microsoft Windows | Patch soon | 0.17 | ||
| 299 | CVE-2023-38180Denial-of-Service | Microsoft .NET Core and Visual Studio | Patch soon | 0.14 | ||
| 300 | CVE-2023-35311Security Feature Bypass | Microsoft Outlook | Patch soon | 0.16 | ||
| 301 | CVE-2016-0165Privilege Escalation | Microsoft Win32k | Patch soon | 0.14 | ||
| 302 | CVE-2023-21715Publisher Security Feature Bypass | Microsoft Office | Patch soon | 0.12 | ||
| 303 | CVE-2015-2360Privilege Escalation | Microsoft Win32k | Patch soon | 0.15 | ||
| 304 | CVE-2020-0986Kernel Privilege Escalation | Microsoft Windows | Patch soon | 0.16 | ||
| 305 | CVE-2025-21333Hyper-V NT Kernel Integration VSP Heap-based Buffer Overflow | Microsoft Windows | Patch soon | 0.10 | ||
| 306 | CVE-2024-38217Mark of the Web (MOTW) Protection Mechanism Failure | Microsoft Windows | Patch soon | 0.10 | ||
| 307 | CVE-2023-36033Desktop Window Manager (DWM) Core Library Privilege Escalation | Microsoft Windows | Patch soon | 0.11 | ||
| 308 | CVE-2023-32046MSHTML Platform Privilege Escalation | Microsoft Windows | Patch soon | 0.10 | ||
| 309 | CVE-2022-26925LSA Spoofing | Microsoft Windows | Patch soon | 0.10 | ||
| 310 | CVE-2017-0005Graphics Device Interface (GDI) Privilege Escalation | Microsoft Windows | Patch soon | 0.11 | ||
| 311 | CVE-2019-0703SMB Information Disclosure | Microsoft Windows | Patch soon | 0.10 | ||
| 312 | CVE-2021-34486Event Tracing Privilege Escalation | Microsoft Windows | Patch soon | 0.09 | ||
| 313 | CVE-2019-1132Privilege Escalation | Microsoft Win32k | Patch soon | 0.10 | ||
| 314 | CVE-2017-0263Privilege Escalation | Microsoft Win32k | Patch soon | 0.10 | ||
| 315 | CVE-2021-33771Kernel Privilege Escalation | Microsoft Windows | Patch soon | 0.10 | ||
| 316 | CVE-2026-20805Information Disclosure | Microsoft Windows | Patch soon | 0.07 | ||
| 317 | CVE-2024-38189Remote Code Execution | Microsoft Project | Patch soon | 0.08 | ||
| 318 | CVE-2024-38080Hyper-V Privilege Escalation | Microsoft Windows | Patch soon | 0.07 | ||
| 319 | CVE-2019-0676Information Disclosure | Microsoft Internet Explorer | Patch soon | 0.08 | ||
| 320 | CVE-2020-0683Installer Privilege Escalation | Microsoft Windows | Patch soon | 0.08 | ||
| 321 | CVE-2020-1040vGPU Remote Code Execution | Microsoft Hyper-V RemoteFX | Patch soon | 0.07 | ||
| 322 | CVE-2021-28310Privilege Escalation | Microsoft Win32k | Patch soon | 0.08 | ||
| 323 | CVE-2025-62215Race Condition | Microsoft Windows | Patch soon | 0.06 | ||
| 324 | CVE-2025-24990Untrusted Pointer Dereference | Microsoft Windows | Patch soon | 0.06 | ||
| 325 | CVE-2024-38014Installer Improper Privilege Management | Microsoft Windows | Patch soon | 0.06 |