Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-73128 Microsoft Windows Command Injection Vulnerability Priority CRITICAL 97KEV 2026-10-13TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability Priority CRITICAL 97KEV 2026-09-25TI-2026-56567 Microsoft Windows Link Following Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records
Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

103 records in Dynamics 365 · all components

TI-2018-06256 CVE-2018-8609 · GHSA-h52h-3mwv-hvcq

Improper output encoding in Microsoft Dynamics 365

Priority MEDIUM 50

A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) version 8 when the server fails to properly sanitize web requests to an affected Dynamics server, aka "Microsoft Dynamics 365 (on-premi…

CVSS 3.0HIGH 8.8 Network Low privileges No interaction EPSS 0.09902 Published 2018-11-14 No fix listed CWE-116
TI-2020-12866 CVE-2020-16862 · GHSA-gq5c-8h36-jg2x

Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability

Priority MEDIUM 46

<p>A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) when the server fails to properly sanitize web requests to an affected Dynamics server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.03392 Published 2020-09-11 Fixed in publication
TI-2026-31102 CVE-2026-42898 · GHSA-f8w6-8hpv-rrjj

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Priority MEDIUM 45

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.01194 Published 2026-05-12 Fixed in 9.1.45.11 CWE-94
TI-2024-25464 CVE-2024-38182 · GHSA-5rh9-r47c-q36p

Microsoft Dynamics 365 Elevation of Privilege Vulnerability

Priority MEDIUM 45

Weak authentication in Microsoft Dynamics 365 allows an unauthenticated attacker to elevate privileges over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00884 Published 2024-07-31 No fix listed CWE-1390
TI-2026-35158 CVE-2026-47647 · GHSA-vq29-76j3-6vh5

Dynamics 365 Elevation of Privilege Vulnerability

Priority MEDIUM 44

Improper access control in Microsoft Dynamics 365 allows an authorized attacker to elevate privileges over a network.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00778 Published 2026-06-18 No fix listed CWE-284
TI-2026-31042 CVE-2026-42833 · GHSA-wq97-r6xw-c5c9

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Priority MEDIUM 43

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network.

CVSS 3.1CRITICAL 9.1 Network High privileges No interaction EPSS 0.00748 Published 2026-05-12 Fixed in 9.1.45.11 CWE-250
TI-2026-24740 CVE-2026-32210 · GHSA-9m2c-xmjv-v2rr

Microsoft Dynamics 365 (online) Spoofing Vulnerability

Priority MEDIUM 43

Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.00584 Published 2026-04-23 No fix listed CWE-918
TI-2020-12864 CVE-2020-16860 · GHSA-94j9-g7hv-h89v

Microsoft Dynamics 365 (on-premises) Remote Code Execution Vulnerability

Priority MEDIUM 43

<p>A remote code execution vulnerability exists in Microsoft Dynamics 365 (on-premises) when the server fails to properly sanitize web requests to an affected Dynamics server.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.02741 Published 2020-09-11 Fixed in publication
TI-2026-54237 CVE-2026-77908 · GHSA-xwmw-4qgg-5h34

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Priority MEDIUM 42

Improper control of generation of code ('code injection') in Microsoft Dynamics 365 allows an authorized attacker to execute code over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00987 Published 2026-09-08 Fixed in 9.1.0048.0004 CWE-94
TI-2026-29146 CVE-2026-40371 · GHSA-q5cq-75qj-crvp

Microsoft Dynamics 365 (on-premises) Elevation of Privilege Vulnerability

Priority MEDIUM 41

Improper handling of insufficient permissions or privileges in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to elevate privileges over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.0063 Published 2026-06-09 Fixed in 9.1.0045.0011 CWE-280
TI-2025-38524 CVE-2025-62211 · GHSA-73jf-9jgw-p56v

Dynamics 365 Field Service (online) Spoofing Vulnerability

Priority MEDIUM 41

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00643 Published 2025-11-11 Fixed in 8.8.139.398 CWE-79
TI-2025-38523 CVE-2025-62210 · GHSA-9rm4-hfxw-q64p

Dynamics 365 Field Service (online) Spoofing Vulnerability

Priority MEDIUM 41

Improper neutralization of input during web page generation ('cross-site scripting') in Dynamics 365 Field Service (online) allows an authorized attacker to perform spoofing over a network.

CVSS 3.1HIGH 8.7 Network Low privileges User interaction EPSS 0.00643 Published 2025-11-11 Fixed in 8.8.139.398 CWE-79
Load more
Open these records in search →