Microsoft vulnerabilities461 known to be exploited.
Microsoft has 21,814 published vulnerabilities across 1,048 products in our catalogue. 461 of them are on the list of flaws known to be exploited, so criminals are using them now. The most affected product is Windows, with 8,294. If you run Microsoft software, patch the exploited flaws first.
The most recent Microsoft flaw added to the known-exploited list is CVE-2026-81963, on 8 September 2026. We keep watching the known-exploited list.
Which Microsoft products have the most vulnerabilities?
Windows leads with 8,294 published vulnerabilities. Open a product to see its versions and which of its flaws criminals are already using.
Which Microsoft vulnerabilities are being exploited?
461 flaws are on the government list of vulnerabilities known to be exploited. These are the ones criminals are using now, so they go first, whatever their severity score says.
- 7.8Microsoft Windows Link Following Vulnerability
Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
- 7.8Microsoft Windows Heap-Based Buffer Overflow Vulnerability
Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.
- 8.8Microsoft SQL Server Remote Code Execution Vulnerability
Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.
- 9.1Microsoft SharePoint Weak Authentication Vulnerability
Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.
- 9.8Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.
- 9.8Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
- 7.8Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
- 5.3Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
Which Microsoft flaws are most likely to be used?
Ranked by the latest exploit-likelihood forecast: the chance each flaw is used in an attack in the next 30 days. A high severity score on its own doesn't tell you that. Flaws shared by many other makers' products are left out.
- 98%CVE-2003-0352High
Buffer overflow in a certain DCOM interface for RPC in Microsoft Windows NT 4.0, 2000, XP, and Server 2003 allows remote attackers to execute arbitrary code via a malformed message, as exploited by the...
- 97%CVE-2001-0500Critical
Buffer overflow in ISAPI extension (idq.dll) in Index Server 2.0 and Indexing Service 2000 in IIS 6.0 beta and earlier allows remote attackers to execute arbitrary commands via a long argument to Internet Data...
- 96%CVE-1999-0016Medium
Land IP denial of service.
- 91%CVE-2001-0333High
Directory traversal vulnerability in IIS 5.0 and earlier allows remote attackers to execute arbitrary commands by encoding ..
- 91%
The Mixed Mode authentication capability in Microsoft SQL Server 7.0 stores the System Administrator (sa) account in plaintext in a log file which is readable by any user, aka the "SQL Server 7.0 Service Pack...
- 88%CVE-2003-0718Medium
The WebDAV Message Handler for Internet Information Services (IIS) 5.0, 5.1, and 6.0 allows remote attackers to cause a denial of service (memory and CPU exhaustion, application crash) via a PROPFIND request with an...
- 87%CVE-2000-1209Critical
The "sa" account is installed with a default null password on (1) Microsoft SQL Server 2000, (2) SQL Server 7.0, and (3) Data Engine (MSDE) 1.0, including third party packages that use these products such as (4)...
- 87%CVE-2000-0778Medium
IIS 5.0 allows remote attackers to obtain source code for .ASP files and other scripts via an HTTP GET request with a "Translate: f" header, aka the "Specialized Header" vulnerability.
- 86%CVE-2001-0241Critical
Buffer overflow in Internet Printing ISAPI extension in Windows 2000 allows remote attackers to gain root privileges via a long print request that is passed to the extension through IIS 5.0.
- 86%CVE-2003-0109High
Buffer overflow in ntdll.dll on Microsoft Windows NT 4.0, Windows NT 4.0 Terminal Server Edition, Windows 2000, and Windows XP allows remote attackers to execute arbitrary code, as demonstrated via a WebDAV request...
All Microsoft products we track.
602 products, most vulnerabilities first. Find the ones you run, then open a product to see its versions and exploited flaws.
- Windowswindows8,294 vulnerabilities11 versions
- Windows Server 2016windows_server_20164,711 vulnerabilities58 versions
- Windows Server 2019windows_server_20194,111 vulnerabilities56 versions
- Windows 10windows_104,066 vulnerabilities15 versions
- Windows Server 2008windows_server_20083,906 vulnerabilities2 versions
- Windows Server 2012windows_server_20123,842 vulnerabilities7 versions
- Windows 7windows_73,087 vulnerabilities2 versions
- Windows 8.1windows_8.12,876 vulnerabilities2 versions
- Windows Rt 8.1windows_rt_8.12,336 vulnerabilities1 version
- Windows Server 2022windows_server_20222,137 vulnerabilities89 versions
- Internet Explorerinternet_explorer1,742 vulnerabilities83 versions
- Windows 11 22H2windows_11_22h21,473 vulnerabilities69 versions
- Windows 10 1809windows_10_18091,465 vulnerabilities148 versions
- Windows 10 21H2windows_10_21h21,430 vulnerabilities86 versions
- Windows 10 22H2windows_10_22h21,425 vulnerabilities56 versions
- Windows Xpwindows_xp1,352 vulnerabilities5 versions
- Windows Vistawindows_vista1,348 vulnerabilities3 versions
- Windows 10 1607windows_10_16071,294 vulnerabilities188 versions
- Windows 10 1507windows_10_15071,131 vulnerabilities144 versions
- Windows Server 2022 23H2windows_server_2022_23h21,060 vulnerabilities30 versions
- Windows 11 21H2windows_11_21h21,031 vulnerabilities73 versions
- Windows 11 23H2windows_11_23h2991 vulnerabilities45 versions
- Officeoffice936 vulnerabilities35 versions
- Edgeedge756 vulnerabilities95 versions
This directory lists the 602 Microsoft products with at least one tracked version, of 1,048 in our catalogue.
Running Microsoft? We'll keep checking.
Looking flaws up one at a time doesn't scale. Tell us what you run once, and we tell you which flaws matter to you, in what order, and keep watching for new ones.
- Tell us what you runPick your software from a list, or let us work it out from your website.
- We match it to every flawOver 400,000 published flaws, checked against your list.
- Ranked by real-world riskA 0 to 100 score, led by evidence criminals are using it.
- Told as soon as we knowAn alert by email, in the app or by webhook to your own tools.
Free plan, no card needed. Nothing to install.
1 flaw being exploited affects software Acme tracks
Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.
- Matched to
- Windows on Acme's software list
- What to do
- Patch first, then check for signs of use
Sent to the alert recipients Acme chose. Also in the app and to Acme's webhook.
Our catalogue lists 21,814 published vulnerabilities across 1,048 products and 13,615 versions from Microsoft. The most recent Microsoft flaw added to the known-exploited list is CVE-2026-81963, on 8 September 2026.
461 Microsoft vulnerabilities are on the list of flaws known to be exploited. The most recently added are CVE-2026-81963, CVE-2026-85880 and CVE-2019-1068. The full list is on this page.
Windows, with 8,294 published vulnerabilities. Its own page lists the ones known to be exploited.
Create a EdgeProtect account and track the Microsoft products you run. We match them against every published flaw, give each one a risk score from 0 to 100 and tell you as soon as we spot one that affects you, by email, in the app or by webhook.