Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-73128 Microsoft Windows Command Injection Vulnerability Priority CRITICAL 97KEV 2026-10-13TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability Priority CRITICAL 97KEV 2026-09-25TI-2026-56567 Microsoft Windows Link Following Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records
Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

8 records in Configuration Manager 2503 · all components

TI-2026-72879 CVE-2026-88075 · GHSA-39vx-m3rf-px34

SQL injection in Microsoft Configuration Manager allows privilege escalation

Priority MEDIUM 42

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00831 Published 2026-10-13 Fixed in 5.00.9135.1040, 5.00.9141.1039 +1 CWE-89
TI-2026-34878 CVE-2026-47301 · GHSA-c9fw-992q-vr57

Configuration Manager Elevation of Privilege Vulnerability

Priority MEDIUM 42

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.01046 Published 2026-07-14 Fixed in 5.0.9135.1031, 5.0.9141.1030 +1 CWE-284
TI-2025-29763 CVE-2025-47178 · GHSA-m728-x6w3-mc25

Microsoft Configuration Manager Remote Code Execution Vulnerability

Priority MEDIUM 42

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to execute code over an adjacent network.

CVSS 3.1HIGH 8.0 Adjacent network Low privileges No interaction EPSS 0.03018 Published 2025-07-08 Fixed in 5.00.9135.1003 CWE-89
TI-2025-36803 CVE-2025-59213 · GHSA-hrc2-g2w7-74hg

Configuration Manager Elevation of Privilege Vulnerability

Priority MEDIUM 40

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an unauthorized attacker to elevate privileges over an adjacent network.

CVSS 3.1HIGH 8.8 Adjacent network No auth No interaction EPSS 0.00369 Published 2025-10-14 Fixed in 5.00.9135.1008, 5.00.9132.1029 CWE-89
TI-2025-34974 CVE-2025-55320 · GHSA-5pj4-xx5h-fm6m

Configuration Manager Elevation of Privilege Vulnerability

Priority LOW 33

Improper neutralization of special elements used in an sql command ('sql injection') in Microsoft Configuration Manager allows an authorized attacker to elevate privileges over an adjacent network.

CVSS 3.1MEDIUM 6.8 Adjacent network High privileges No interaction EPSS 0.00677 Published 2025-10-14 Fixed in 5.00.9135.1008, 5.00.9132.1029 CWE-89
TI-2025-29764 CVE-2025-47179 · GHSA-fhx9-g9rq-h389

Configuration Manager Elevation of Privilege Vulnerability

Priority LOW 32

Improper access control in Microsoft Configuration Manager allows an authorized attacker to elevate privileges locally.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00372 Published 2025-11-11 Fixed in 5.00.9128.1037, 5.00.9132.1031 CWE-284
TI-2025-37037 CVE-2025-59501 · GHSA-9wxc-6566-9fgm

Microsoft Configuration Manager Spoofing Vulnerability

Priority LOW 28

Authentication bypass by spoofing in Microsoft Configuration Manager allows an authorized attacker to perform spoofing over an adjacent network.

CVSS 3.1MEDIUM 4.8 Adjacent network Low privileges No interaction EPSS 0.03282 Published 2025-10-31 Fixed in 5.00.9128.1037, 5.00.9132.1031 CWE-290
Open these records in search →