Microsoft has 2,953 CVEs on record between 2013 and 2026. Disclosure cadence is accelerating: 2136 in the last 90 days against 414 in the 90 before. The busiest recent month was September 2026 with 1005. The median CVSS is 7.8 (high), with 178 rated critical. 3% have been exploited in the wild, in line with the corpus average. The median gap from publication to a KEV listing is 113 days (91 cases). The dominant weakness classes are CWE-122 (585) and CWE-416 (512). Most affected products: windows_10_1607 (644), Windows 10 Version 1607 (481), Microsoft 365 Apps for Enterprise (209).

CVEs per month

Last 12 months, by publish date

1025/101125/111225/120126/010226/020326/030426/040526/050626/060726/070826/080926/09

Exploited share: 3% vs 1% corpus
Median CVSS: 7.8
Publish → KEV: 113 d median(91)
Last 90 days: 2136 prev 414

Weakness classes

Products

windows_10_1607 644
Windows 10 Version 1607 481
Microsoft 365 Apps for Enterprise 209
windows_10 122
365_apps 115
windows_10_1809 106

Follow Microsoft:RSS feed Save a search →Embed badge ↗

2953

Total CVEs

178

Critical

91

CISA KEV

92

Exploited

Worst active — by depth score

Microsoft vulnerabilities

CVEs affecting Microsoft, newest first. Open any entry for full detail, references, and exploit status.

2953 CVEsRSS

CVE-2025-24993High· 7.8CISA KEV0day

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

▾ Abyssalmicrosoft · windows_10_1507EPSS 2.2%via NVD

CVE-2025-26633High· 7.0CISA KEV0dayPoC

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

▾ Abyssalmicrosoft · windows_10_1507EPSS 30%via NVD

CVE-2025-21391High· 7.1CISA KEV0day

Windows Storage Elevation of Privilege Vulnerability

Windows Storage Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · windows_10_1507EPSS 2.3%via NVD

CVE-2025-21335High· 7.8CISA KEV0day

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

Windows Hyper-V NT Kernel Integration VSP Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · windows_10_21h2EPSS 1.4%via NVD

CVE-2024-49039High· 8.8CISA KEV0dayPoC

Windows Task Scheduler Elevation of Privilege Vulnerability

Windows Task Scheduler Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · windows_10_1507EPSS 14%via NVD

CVE-2024-43590High· 7.8

Visual C++ Redistributable Installer Elevation of Privilege Vulnerability

Visual C++ Redistributable Installer Elevation of Privilege Vulnerability

▾ Twilightmicrosoft · visual_c++_redistributableEPSS 0.43%via NVD

CVE-2024-35260High· 8.0

An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.

An authenticated attacker can exploit an untrusted search path vulnerability in Microsoft Dataverse to execute code over a network.

▾ Twilightmicrosoft · power_platformEPSS 0.83%via NVD

CVE-2024-38093Medium· 4.3

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

▾ Sunlitmicrosoft · edgeEPSS 0.50%via NVD

CVE-2024-38082Medium· 4.7

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

▾ Sunlitmicrosoft · edgeEPSS 0.50%via NVD

CVE-2024-38083Medium· 4.3

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

▾ Sunlitmicrosoft · edge_chromiumEPSS 0.50%via NVD

CVE-2024-30058Medium· 5.4

Microsoft Edge (Chromium-based) Spoofing Vulnerability

Microsoft Edge (Chromium-based) Spoofing Vulnerability

▾ Sunlitmicrosoft · edge_chromiumEPSS 0.40%via NVD

CVE-2024-30057Medium· 5.4

Microsoft Edge for iOS Spoofing Vulnerability

Microsoft Edge for iOS Spoofing Vulnerability

▾ Sunlitmicrosoft · edgeEPSS 0.41%via NVD

CVE-2024-37325High· 8.1

Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability

Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability

▾ Twilightmicrosoft · azure_data_science_virtual_machineEPSS 1.1%via NVD

CVE-2024-35265High· 7.0

Windows Perception Service Elevation of Privilege Vulnerability

Windows Perception Service Elevation of Privilege Vulnerability

▾ Twilightmicrosoft · windows_10_1809EPSS 0.37%via NVD

CVE-2024-35263Medium· 5.7

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

▾ Sunlitmicrosoft · dynamics_365EPSS 1.7%via NVD

CVE-2024-35254High· 7.1

Azure Monitor Agent Elevation of Privilege Vulnerability

Azure Monitor Agent Elevation of Privilege Vulnerability

▾ Twilightmicrosoft · azure_monitor_agentEPSS 0.83%via NVD

CVE-2024-35253Medium· 4.4

Microsoft Azure File Sync Elevation of Privilege Vulnerability

Microsoft Azure File Sync Elevation of Privilege Vulnerability

▾ Sunlitmicrosoft · azure_file_syncEPSS 0.74%via NVD

CVE-2024-35252High· 7.5

Azure Storage Movement Client Library Denial of Service Vulnerability

Azure Storage Movement Client Library Denial of Service Vulnerability

▾ Twilightmicrosoft · azure_storage_data_movement_libraryEPSS 2.5%via NVD

CVE-2024-35250High· 7.8CISA KEVPoC

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

▾ Abyssalmicrosoft · windows_10_1507EPSS 25%via NVD

CVE-2024-35249High· 8.8

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

▾ Twilightmicrosoft · dynamics_365_business_centralEPSS 3.4%via NVD

CVE-2024-35248High· 7.3

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

▾ Twilightmicrosoft · dynamics_365_business_centralEPSS 0.95%via NVD

CVE-2024-30104High· 7.8

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office Remote Code Execution Vulnerability

▾ Twilightmicrosoft · 365_appsEPSS 1.5%via NVD

CVE-2024-30103High· 8.8

Microsoft Outlook Remote Code Execution Vulnerability

Microsoft Outlook Remote Code Execution Vulnerability

▾ Twilightmicrosoft · 365_appsEPSS 3.4%via NVD

CVE-2024-30101High· 7.5

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office Remote Code Execution Vulnerability

▾ Twilightmicrosoft · 365_appsEPSS 1.8%via NVD

CVE-2024-30099High· 7.0

Windows Kernel Elevation of Privilege Vulnerability

Windows Kernel Elevation of Privilege Vulnerability

▾ Twilightmicrosoft · windows_10_1507EPSS 0.54%via NVD

CVE-2024-30097High· 8.8

Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability

Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability

▾ Twilightmicrosoft · windows_10_1507EPSS 1.7%via NVD

CVE-2024-30096Medium· 5.5

Windows Cryptographic Services Information Disclosure Vulnerability

Windows Cryptographic Services Information Disclosure Vulnerability

▾ Sunlitmicrosoft · windows_10_1809EPSS 0.95%via NVD

CVE-2024-30095High· 7.8

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

▾ Twilightmicrosoft · windows_10_1507EPSS 1.0%via NVD

CVE-2024-30094High· 7.8

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

▾ Twilightmicrosoft · windows_10_1507EPSS 0.91%via NVD

CVE-2024-30093High· 7.3

Windows Storage Elevation of Privilege Vulnerability

Windows Storage Elevation of Privilege Vulnerability

▾ Twilightmicrosoft · windows_10_1507EPSS 1.1%via NVD

Microsoft vulnerabilities (CVEs) — page 89 · VulnSea