Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-73128 Microsoft Windows Command Injection Vulnerability Priority CRITICAL 97KEV 2026-10-13TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability Priority CRITICAL 97KEV 2026-09-25TI-2026-56567 Microsoft Windows Link Following Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records
Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

14 records in Entra Id · all components

TI-2026-49066 CVE-2026-69836 · GHSA-v6wh-624g-vvmv

Microsoft Entra ID Remote Code Execution Vulnerability

Priority MEDIUM 53

Deserialization of untrusted data in Microsoft Entra ID allows an unauthorized attacker to execute code over a network.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01842 Published 2026-08-20 No fix listed CWE-502
TI-2026-57733 CVE-2026-83941 · GHSA-22qv-2gmj-p6v2

Entra ID Elevation of Privilege Vulnerability

Priority MEDIUM 50

Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00778 Published 2026-09-08 No fix listed CWE-862
TI-2026-44972 CVE-2026-62916 · GHSA-77pq-762c-pm6c

Microsoft Entra ID Elevation of Privilege Vulnerability

Priority MEDIUM 50

Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00865 Published 2026-09-03 No fix listed CWE-288
TI-2026-31105 CVE-2026-42901 · GHSA-2jpj-7p7q-hfqj

Microsoft Entra ID Elevation of Privilege Vulnerability

Priority MEDIUM 49

Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00301 Published 2026-05-22 No fix listed CWE-346
TI-2026-27565 CVE-2026-35431 · GHSA-7r3r-j3vr-c4w6

Microsoft Entra ID Entitlement Management Spoofing Vulnerability

Priority MEDIUM 49

Server-side request forgery (ssrf) in Microsoft Entra ID Entitlement Management allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.00511 Published 2026-04-23 No fix listed CWE-918
TI-2026-26209 CVE-2026-33843 · GHSA-5gj2-5693-p684

Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability

Priority MEDIUM 49

Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00473 Published 2026-05-22 No fix listed CWE-288
TI-2026-49075 CVE-2026-69851 · GHSA-cwh9-8jgj-qpcf

Microsoft Entra ID Elevation of Privilege Vulnerability

Priority MEDIUM 44

Server-side request forgery (ssrf) in Azure Active Directory allows an authorized attacker to elevate privileges over a network.

CVSS 3.1CRITICAL 9.9 Network Low privileges No interaction EPSS 0.00778 Published 2026-08-20 No fix listed CWE-918
TI-2026-29153 CVE-2026-40379 · GHSA-xq38-4286-vwhm

Azure Entra ID Spoofing Vulnerability

Priority MEDIUM 44

Exposure of sensitive information to an unauthorized actor in Azure Entra ID allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1CRITICAL 9.3 Network No auth User interaction EPSS 0.0091 Published 2026-05-12 No fix listed CWE-200
TI-2024-29120 CVE-2024-43477 · GHSA-23fw-5352-7h9v

Microsoft Entra ID Elevation of Privilege Vulnerability

Priority MEDIUM 41

Improper access control in Decentralized Identity Services resulted in a vulnerability that allows an unauthenticated attacker to disable Verifiable ID's on another tenant.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01043 Published 2024-08-23 No fix listed CWE-284
TI-2026-44932 CVE-2026-62869 · GHSA-486h-mp6h-x926

Azure Entra ID Spoofing Vulnerability

Priority MEDIUM 40

Insufficient verification of data authenticity in Azure Entra ID allows an authorized attacker to perform spoofing over a network.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00443 Published 2026-08-11 No fix listed CWE-345
Open these records in search →