microsoft security advisories
60 threat alerts tracking vulnerabilities and security advisories that affect microsoft products.
Vulnios monitors microsoft CVE feeds, vendor advisories, CISA KEV listings, and exploit-prediction data continuously. Each alert below is enriched with severity, exploitation status, affected products, and a remediation path. Use this page to scan recent microsoft security news in one place, or click into an individual alert for full detail.
Critical Vulnerability: CVE-2022-34718 — microsoft — windows_10, windows_11
Windows TCP/IP Remote Code Execution Vulnerability
criticalCVE-2022-34718Critical Vulnerability: CVE-2024-49112 — microsoft — windows_10_1507, windows_10_1607
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
criticalCVE-2024-49112Critical Vulnerability: CVE-2025-55241 — microsoft — entra_id
Azure Entra ID Elevation of Privilege Vulnerability
criticalCVE-2025-55241Critical Vulnerability: CVE-2025-54914 — microsoft — azure_networking
Azure Networking Elevation of Privilege Vulnerability
criticalCVE-2025-54914Critical Vulnerability: CVE-2025-55315 — microsoft — asp.net_core, visual_studio_2022
Inconsistent interpretation of http requests ('http request/response smuggling') in ASP.NET Core allows an authorized attacker to bypass a security feature over a network.
criticalCVE-2025-55315Critical Vulnerability: CVE-2025-64657 — microsoft — azure_application_gateway
Stack-based buffer overflow in Azure Application Gateway allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2025-64657Critical Vulnerability: CVE-2025-64656 — microsoft — azure_application_gateway
Out-of-bounds read in Application Gateway allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2025-64656Critical Vulnerability: CVE-2025-59245 — microsoft — sharepoint_online
Microsoft SharePoint Online Elevation of Privilege Vulnerability
criticalCVE-2025-59245Critical Vulnerability: CVE-2025-49752 — microsoft — azure_bastion_developer
Azure Bastion Elevation of Privilege Vulnerability
criticalCVE-2025-49752Critical Vulnerability: CVE-2025-59246 — microsoft — entra_id
Azure Entra ID Elevation of Privilege Vulnerability
criticalCVE-2025-59246Critical Vulnerability: CVE-2025-59272 — microsoft — 365_copilot_chat
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to perform information disclosure locally.
criticalCVE-2025-59272Critical Vulnerability: CVE-2025-59252 — microsoft — 365_word_copilot
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
criticalCVE-2025-59252Critical Vulnerability: CVE-2025-59286 — microsoft — 365_copilot_chat
Improper neutralization of special elements used in a command ('command injection') in Copilot allows an unauthorized attacker to disclose information over a network.
criticalCVE-2025-59286Critical Vulnerability: CVE-2025-55321 — microsoft — azure_monitor
Improper neutralization of input during web page generation ('cross-site scripting') in Azure Monitor allows an unauthorized attacker to perform spoofing over a network.
criticalCVE-2025-55321Critical Vulnerability: CVE-2025-59218 — microsoft — entra_id
Azure Entra ID Elevation of Privilege Vulnerability
criticalCVE-2025-59218Critical Vulnerability: CVE-2025-59503 — microsoft — azure_compute_resource_provider
Server-side request forgery (ssrf) in Azure Compute Gallery allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2025-59503Critical Vulnerability: CVE-2020-0796 — microsoft — windows_10_1903, windows_10_1909
A remote code execution vulnerability exists in the way that the Microsoft Server Message Block 3.1.1 (SMBv3) protocol handles certain requests, aka 'Windows SMBv3 Client/Server Remote Code Execution
criticalCVE-2020-0796Critical Vulnerability: CVE-2024-21400 — microsoft — confcom
Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
criticalCVE-2024-21400Critical Vulnerability: CVE-2023-21689 — microsoft — windows_10_1507, windows_10_1607
Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
criticalCVE-2023-21689Critical Vulnerability: CVE-2021-27078 — microsoft — exchange_server
Microsoft Exchange Server Remote Code Execution Vulnerability
criticalCVE-2021-27078Critical Vulnerability: CVE-2023-21690 — microsoft — windows_10_1507, windows_10_1607
Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
criticalCVE-2023-21690Critical Vulnerability: CVE-2021-26412 — microsoft — exchange_server
Microsoft Exchange Server Remote Code Execution Vulnerability
criticalCVE-2021-26412Critical Vulnerability: CVE-2021-26895 — microsoft — windows_server_2008, windows_server_2012
Windows DNS Server Remote Code Execution Vulnerability
criticalCVE-2021-26895Critical Vulnerability: CVE-2023-21716 — microsoft — office, office_long_term_servicing_channel
Microsoft Word Remote Code Execution Vulnerability
criticalCVE-2023-21716Critical Vulnerability: CVE-2021-26867 — microsoft — windows_10, windows_server_2016
Windows Hyper-V Remote Code Execution Vulnerability
criticalCVE-2021-26867Critical Vulnerability: CVE-2021-26443 — microsoft — windows_10, windows_11
Microsoft Virtual Machine Bus (VMBus) Remote Code Execution Vulnerability
criticalCVE-2021-26443Critical Vulnerability: CVE-2023-21803 — microsoft — windows_10, windows_10_1607
Windows iSCSI Discovery Service Remote Code Execution Vulnerability
criticalCVE-2023-21803Critical Vulnerability: CVE-2021-26897 — microsoft — windows_server_2008, windows_server_2012
Windows DNS Server Remote Code Execution Vulnerability
criticalCVE-2021-26897Critical Vulnerability: CVE-2021-27080 — microsoft — azure_sphere
Azure Sphere Unsigned Code Execution Vulnerability
criticalCVE-2021-27080Critical Vulnerability: CVE-2023-21692 — microsoft — windows_10_1507, windows_10_1607
Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability
criticalCVE-2023-21692Critical Vulnerability: CVE-2021-26877 — microsoft — windows_server_2008, windows_server_2012
Windows DNS Server Remote Code Execution Vulnerability
criticalCVE-2021-26877Critical Vulnerability: CVE-2021-26894 — microsoft — windows_server_2008, windows_server_2012
Windows DNS Server Remote Code Execution Vulnerability
criticalCVE-2021-26894Critical Vulnerability: CVE-2021-26893 — microsoft — windows_server_2008, windows_server_2012
Windows DNS Server Remote Code Execution Vulnerability
criticalCVE-2021-26893Critical Vulnerability: CVE-2024-21401 — microsoft — entra_jira_sso_plugin
Microsoft Entra Jira Single-Sign-On Plugin Elevation of Privilege Vulnerability
criticalCVE-2024-21401Critical Vulnerability: CVE-2024-21376 — microsoft — azure_kubernetes_service
Microsoft Azure Kubernetes Service Confidential Container Remote Code Execution Vulnerability
criticalCVE-2024-21376Critical Vulnerability: CVE-2024-38220 — microsoft — azure_stack_hub
Azure Stack Hub Elevation of Privilege Vulnerability
criticalCVE-2024-38220Critical Vulnerability: CVE-2024-21364 — microsoft — azure_site_recovery
Microsoft Azure Site Recovery Elevation of Privilege Vulnerability
criticalCVE-2024-21364Critical Vulnerability: CVE-2024-21403 — microsoft — azure_kubernetes_service
Microsoft Azure Kubernetes Service Confidential Container Elevation of Privilege Vulnerability
criticalCVE-2024-21403Critical Vulnerability: CVE-2024-38183 — microsoft — groupme
An improper access control vulnerability in GroupMe allows an a unauthenticated attacker to elevate privileges over a network.
criticalCVE-2024-38183Critical Vulnerability: CVE-2023-36910 — microsoft — windows_10, windows_10_1607
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
criticalCVE-2023-36910Critical Vulnerability: CVE-2023-21709 — microsoft — exchange_server
Microsoft Exchange Server Elevation of Privilege Vulnerability
criticalCVE-2023-21709Critical Vulnerability: CVE-2023-35385 — microsoft — windows_10_1507, windows_10_1607
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
criticalCVE-2023-35385Critical Vulnerability: CVE-2023-36911 — microsoft — windows_10, windows_10_1607
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
criticalCVE-2023-36911Critical Vulnerability: CVE-2021-34458 — microsoft — windows_server_2016, windows_server_2019
Windows Kernel Remote Code Execution Vulnerability
criticalCVE-2021-34458Critical Vulnerability: CVE-2021-26432 — microsoft — windows_10, windows_8.1
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
criticalCVE-2021-26432Critical Vulnerability: CVE-2021-26424 — microsoft — windows_10, windows_7
Windows TCP/IP Remote Code Execution Vulnerability
criticalCVE-2021-26424Critical Vulnerability: CVE-2026-24304 — microsoft — azure_resource_manager
Improper access control in Azure Resource Manager allows an authorized attacker to elevate privileges over a network.
criticalCVE-2026-24304Critical Vulnerability: CVE-2026-40412 — microsoft — azure_orbital_spatio
Unrestricted upload of file with dangerous type in Azure Orbital Spatio allows an unauthorized attacker to execute code over a network.
criticalCVE-2026-40412Critical Vulnerability: CVE-2026-47280 — microsoft — azure_resource_manager
Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-47280Critical Vulnerability: CVE-2026-23652 — microsoft — power_pages
Improper neutralization of special elements used in a command ('command injection') in Microsoft Power Pages allows an unauthorized attacker to execute code over a network.
criticalCVE-2026-23652Critical Vulnerability: CVE-2026-41104 — microsoft — planetary_computer
Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network.
criticalCVE-2026-41104Critical Vulnerability: CVE-2026-33843 — microsoft — entra_id
Authentication bypass using an alternate path or channel in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-33843Critical Vulnerability: CVE-2026-42901 — microsoft — entra_id
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
criticalCVE-2026-42901Critical Vulnerability: CVE-2026-41090 — microsoft — 365_copilot
Improper neutralization of special elements used in a command ('command injection') in Microsoft Copilot allows an unauthorized attacker to perform tampering over a network.
criticalCVE-2026-41090Critical Vulnerability: CVE-2026-40411 — microsoft — azure_virtual_network_gateway
Improper input validation in Azure Virtual Network Gateway allows an authorized attacker to execute code over a network.
criticalCVE-2026-40411Critical Vulnerability: CVE-2024-30080 — microsoft — windows_10_1507, windows_10_1607
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
criticalCVE-2024-30080Critical Vulnerability: CVE-2025-62821 — microsoft — heif_image_extension
Microsoft HEIF Image Extensions 1.2.22.0 has an out-of-bounds read because CHEIFItemInfoEntry_GetDataSize can return success while leaving the reported data size as 0. This causes a caller to make a 1
criticalCVE-2025-62821Critical Vulnerability: CVE-2021-43899 — microsoft — wireless_display_adapter_firmware, wireless_display_adapter
Microsoft 4K Wireless Display Adapter Remote Code Execution Vulnerability
criticalCVE-2021-43899Critical Vulnerability: CVE-2021-42313 — microsoft — defender_for_iot
Microsoft Defender for IoT Remote Code Execution Vulnerability
criticalCVE-2021-42313Critical Vulnerability: CVE-2021-42311 — microsoft — defender_for_iot
Microsoft Defender for IoT Remote Code Execution Vulnerability
criticalCVE-2021-42311
Showing the 60 most recent. Older alerts are archived but still reachable via search and the main feed.
Track microsoft exposure across your environment
Vulnios automatically cross-references your asset inventory against new microsoft CVEs and surfaces only what affects you. No more sifting manually — actionable findings only.
Start a free scan