Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-73128 Microsoft Windows Command Injection Vulnerability Priority CRITICAL 97KEV 2026-10-13TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability Priority CRITICAL 97KEV 2026-09-25TI-2026-56567 Microsoft Windows Link Following Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records
Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

8 records in 365 Copilot Chat · all components

TI-2026-21130 CVE-2026-26137 · GHSA-88qf-p934-h9qg

Microsoft Exchange Elevation of Privilege Vulnerability

Priority MEDIUM 44

Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.0056 Published 2026-03-19 No fix listed CWE-918
TI-2025-36862 CVE-2025-59286 · GHSA-hh8r-hx5c-8r8r

Copilot Information Disclosure Vulnerability

Priority MEDIUM 43

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00567 Published 2025-10-09 No fix listed CWE-77
TI-2025-36852 CVE-2025-59272 · GHSA-c2c2-fj7w-fhpr

Copilot Information Disclosure Vulnerability

Priority MEDIUM 43

Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally.

CVSS 3.1CRITICAL 9.3 Network No auth No interaction EPSS 0.00567 Published 2025-10-09 No fix listed CWE-77
TI-2026-21122 CVE-2026-26129 · GHSA-hpvr-rjcg-4q53

M365 Copilot Information Disclosure Vulnerability

Priority MEDIUM 41

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01135 Published 2026-05-07 No fix listed CWE-138
TI-2026-21155 CVE-2026-26164 · GHSA-qvcj-rgrx-wm72

M365 Copilot Information Disclosure Vulnerability

Priority MEDIUM 40

Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00799 Published 2026-05-07 No fix listed CWE-74
TI-2026-54585 CVE-2026-78501 · GHSA-hjj2-64g6-jw5p

Microsoft 365 Copilot Business Chat Information Disclosure Vulnerability

Priority LOW 38

Improper neutralization of special elements used in a command ('command injection') in Microsoft 365 Copilot's Business Chat allows an unauthorized attacker to disclose information over a network.

CVSS 3.1HIGH 8.6 Network No auth No interaction EPSS 0.0054 Published 2026-09-17 No fix listed CWE-77
Open these records in search →