Product of Microsoft
Windows
As of , 174 Microsoft Windows vulnerabilities are on CISA's list of exploited vulnerabilities, 49 of them used in ransomware campaigns; 13 were added in 2026. Patch first: CVE-2025-60710.
Patch first
| # | Vulnerability | Product | Our group | Listed | Deadline | EPSS |
|---|---|---|---|---|---|---|
| 1 | CVE-2025-60710Link Following | Microsoft Windows | Patch nowRansomware use, listed within a year | 0.05 | ||
| 2 | CVE-2008-4250Buffer Overflow | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.99; verified Exploit-DB entry | 0.99 | ||
| 3 | CVE-2008-0015Video ActiveX Control Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.77; verified Exploit-DB entry | 0.77 | ||
| 4 | CVE-2013-3918Out-of-Bounds Write | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.74; verified Exploit-DB entry | 0.74 | ||
| 5 | CVE-2010-2568Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.91; verified Exploit-DB entry | 0.91 | ||
| 6 | CVE-2015-0016TS WebProxy Directory Traversal | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.76; verified Exploit-DB entry | 0.76 | ||
| 7 | CVE-2015-2426Adobe Type Manager Library Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.87; verified Exploit-DB entry | 0.87 | ||
| 8 | CVE-2014-6332Object Linking & Embedding (OLE) Automation Array Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.95; verified Exploit-DB entry | 0.95 | ||
| 9 | CVE-2017-0146SMB Remote Code Execution | Microsoft Windows | Patch this weekRansomware use; Metasploit module; EPSS 0.90; verified Exploit-DB entry | 0.90 | ||
| 10 | CVE-2014-4114Object Linking & Embedding (OLE) Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.82; verified Exploit-DB entry | 0.82 | ||
| 11 | CVE-2014-6352Code Injection | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.77; verified Exploit-DB entry | 0.77 | ||
| 12 | CVE-2017-0143Server Message Block (SMBv1) Remote Code Execution | Microsoft Windows | Patch this weekRansomware use; Metasploit module; EPSS 0.93; verified Exploit-DB entry | 0.93 | ||
| 13 | CVE-2019-0841AppX Deployment Service (AppXSVC) Privilege Escalation | Microsoft Windows | Patch this weekRansomware use; Metasploit module; verified Exploit-DB entry | 0.41 | ||
| 14 | CVE-2019-1405Universal Plug and Play (UPnP) Service Privilege Escalation | Microsoft Windows | Patch this weekRansomware use; Metasploit module; verified Exploit-DB entry | 0.30 | ||
| 15 | CVE-2010-0232Kernel Exception Handler | Microsoft Windows | Patch this weekMetasploit module; verified Exploit-DB entry | 0.29 | ||
| 16 | CVE-2013-5065Kernel Privilege Escalation | Microsoft Windows | Patch this weekMetasploit module; verified Exploit-DB entry | 0.35 | ||
| 17 | CVE-2016-0099Secondary Logon Service Privilege Escalation | Microsoft Windows | Patch this weekRansomware use; Metasploit module; verified Exploit-DB entry | 0.37 | ||
| 18 | CVE-2016-0040Kernel Privilege Escalation | Microsoft Windows | Patch this weekMetasploit module; verified Exploit-DB entry | 0.24 | ||
| 19 | CVE-2019-1322Privilege Escalation | Microsoft Windows | Patch this weekRansomware use; Metasploit module; verified Exploit-DB entry | 0.19 | ||
| 20 | CVE-2025-59287Server Update Service (WSUS) Deserialization of Untrusted Data | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.99 | 0.99 | ||
| 21 | CVE-2011-3402Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.78 | 0.78 | ||
| 22 | CVE-2025-33053External Control of File Name or Path | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.87 | 0.87 | ||
| 23 | CVE-2018-0824COM for Windows Deserialization of Untrusted Data | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.73 | 0.73 | ||
| 24 | CVE-2022-30190Support Diagnostic Tool (MSDT) Remote Code Execution | Microsoft Windows | Patch this weekRansomware use; Metasploit module; EPSS 0.99 | 0.99 | ||
| 25 | CVE-2017-8464Shell (.lnk) Remote Code Execution | Microsoft Windows | Patch this weekMetasploit module; EPSS 0.90 | 0.90 |
Added each year
Show the numbers
| Period | entries added |
|---|---|
| 2021 | 28 |
| 2022 | 66 |
| 2023 | 14 |
| 2024 | 24 |
| 2025 | 29 |
| 2026 | 13 |