Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV

Components

Products in the NVD configurations · select one to filter the records

Records

15 records in Onedrive · all components

Priority MEDIUM 42

Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.05433 Published 2018-06-26 No fix listed CWE-426
Priority MEDIUM 42

Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

CVSS 3.0HIGH 7.8 Local No auth User interaction EPSS 0.05433 Published 2018-06-26 No fix listed CWE-426
Priority LOW 33

Improper limitation of a pathname to a restricted directory ('path traversal') in OneDrive for Android allows an authorized attacker to elevate privileges over a network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00881 Published 2025-11-11 Fixed in 7.42 CWE-22
Priority LOW 33

<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.0099 Published 2020-09-11 Fixed in publication CWE-59
Priority LOW 33

<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00934 Published 2020-09-11 Fixed in publication
Priority LOW 33

<p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.00967 Published 2020-09-11 Fixed in publication CWE-59
Priority LOW 32

Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.

CVSS 3.1MEDIUM 6.7 Local High privileges No interaction EPSS 0.00387 Published 2026-08-11 Fixed in 26.095.0519.0003 CWE-59
Priority LOW 26

An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links, aka 'OneDrive for Windows Elevation of Privilege Vulnerability'.

CVSS 3.1MEDIUM 5.5 Local Low privileges No interaction EPSS 0.00768 Published 2020-04-15 No fix listed CWE-269
Open these records in search →