Read the docs

Microsoft

Records18046All Threatist records
Exploited (KEV)406In CISA KEV
CVSS critical2330CVSS 9.0–10.0
CVSS high10410CVSS 7.0–8.9

Exploited now

Microsoft records in CISA KEV
TI-2026-79288 Google Brotli Unchecked Return Value Vulnerability Priority CRITICAL 99KEV 2026-10-27TI-2026-73128 Microsoft Windows Command Injection Vulnerability Priority CRITICAL 97KEV 2026-10-13TI-2026-46806 Microsoft SharePoint Code Injection Vulnerability Priority CRITICAL 97KEV 2026-09-25TI-2026-56567 Microsoft Windows Link Following Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2026-58845 Microsoft Windows Heap-Based Buffer Overflow Vulnerability Priority CRITICAL 93KEV 2026-09-08TI-2019-00798 Microsoft SQL Server Remote Code Execution Vulnerability Priority CRITICAL 97KEV 2026-08-26

Components

Products in the NVD configurations · select one to filter the records
Windows Server 2019 6456 records CRITICAL Windows Server 2016 6401 records CRITICAL Windows Server 2012 5294 records CRITICAL Windows Server 2022 4946 records CRITICAL Windows 10 1809 4017 records CRITICAL Windows 10 21h2 3968 records CRITICAL Windows 10 22h2 3967 records CRITICAL Windows Server 2025 3632 records CRITICAL

Records

24 records in Skype For Business Server · all components

TI-2026-47101 CVE-2026-66302 · GHSA-j9qr-gj45-j8p8

Skype for Business Remote Code Execution Vulnerability

Priority MEDIUM 51

External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.

CVSS 3.1CRITICAL 9.8 Network No auth No interaction EPSS 0.00974 Published 2026-09-08 Fixed in 6.0.9319.885, 7.0.2046.569 +1 CWE-73
TI-2026-47106 CVE-2026-66307 · GHSA-fmx2-865f-8c6j

Skype for Business and Lync Denial of Service Vulnerability

Priority MEDIUM 41

Integer underflow (wrap or wraparound) in Skype for Business allows an unauthorized attacker to deny service over a network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01174 Published 2026-09-08 Fixed in 6.0.9319.885, 7.0.2046.569 +1 CWE-191
TI-2026-47103 CVE-2026-66304 · GHSA-wwcv-p4qq-wm65

Skype for Business Information Disclosure Vulnerability

Priority MEDIUM 41

Server-side request forgery (ssrf) in Skype for Business allows an unauthorized attacker to disclose information over a network.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.00973 Published 2026-09-08 Fixed in 6.0.9319.885, 7.0.2046.569 +1 CWE-918
TI-2026-48945 CVE-2026-69646 · GHSA-935c-p9xv-m74w

Skype for Business Spoofing Vulnerability

Priority LOW 38

Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.

CVSS 3.1HIGH 8.3 Adjacent network No auth No interaction EPSS 0.0032 Published 2026-09-08 Fixed in 6.0.9319.885, 7.0.2046.569 +1 CWE-347
TI-2026-47104 CVE-2026-66305 · GHSA-9823-h4m8-w7cq

Skype for Business Spoofing Vulnerability

Priority LOW 32

Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.

CVSS 3.1HIGH 7.1 Network Low privileges No interaction EPSS 0.00526 Published 2026-09-08 Fixed in 6.0.9319.885, 7.0.2046.569 +1 CWE-603
TI-2026-47107 CVE-2026-66308 · GHSA-hwrf-3w89-xf2g

Skype for Business and Lync Denial of Service Vulnerability

Priority LOW 31

Out-of-bounds read in Skype for Business allows an authorized attacker to deny service over a network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01138 Published 2026-09-08 Fixed in 6.0.9319.885, 7.0.2046.569 +1 CWE-125
TI-2026-47105 CVE-2026-66306 · GHSA-f56r-qvv6-jr8m

Skype for Business Information Disclosure Vulnerability

Priority LOW 31

Generation of error message containing sensitive information in Skype for Business allows an unauthorized attacker to disclose information over a network.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00922 Published 2026-09-08 Fixed in 6.0.9319.885, 7.0.2046.569 +1 CWE-209
TI-2026-47102 CVE-2026-66303 · GHSA-g37h-5rqx-hvqg

Skype for Business and Lync Denial of Service Vulnerability

Priority LOW 31

Null pointer dereference in Skype for Business allows an authorized attacker to deny service over a network.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.01138 Published 2026-09-08 Fixed in 6.0.9319.885, 7.0.2046.569 +1 CWE-476
TI-2019-00563 CVE-2019-0798 · GHSA-43cx-jhp3-2qcr

Cross-site scripting in Microsoft Skype for Business Server 2015

Priority LOW 31

A spoofing vulnerability exists when a Lync Server or Skype for Business Server does not properly sanitize a specially crafted request, aka 'Skype for Business and Lync Spoofing Vulnerability'.

CVSS 3.0MEDIUM 6.1 Network No auth User interaction EPSS 0.02084 Published 2019-04-09 No fix listed CWE-79
TI-2026-45253 CVE-2026-63523 · GHSA-cgvg-jx73-642p

Skype for Business Spoofing Vulnerability

Priority LOW 30

Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1MEDIUM 6.5 Network No auth User interaction EPSS 0.00553 Published 2026-09-08 Fixed in 6.0.9319.885, 7.0.2046.569 +1 CWE-79
TI-2026-48942 CVE-2026-69642 · GHSA-9xj5-8pjr-q9g3

Skype for Business Spoofing Vulnerability

Priority LOW 29

Improper neutralization of input during web page generation ('cross-site scripting') in Skype for Business allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1MEDIUM 6.5 Network No auth No interaction EPSS 0.00413 Published 2026-09-08 Fixed in 6.0.9319.885, 7.0.2046.569 +1 CWE-79
Open these records in search →