Microsoft vendor intelligence
Microsoft Known Exploited Vulnerabilities
Track evidence-backed exploitation affecting Microsoft products, including the gap beyond CISA KEV, confidence assessments, sensor observations, and practical response context.
- Total KEVs
- 410
- Known exploited vulnerabilities affecting Microsoft products
- In CISA KEV
- 389
- Records also listed in the official catalog
- Beyond CISA KEV
- 21
- Additional exploited vulnerabilities absent from CISA KEV
- Sensor Observed
- 7
- Microsoft KEVs with sensor-observed exploitation activity
The catalog gap matters for Microsoft exposure
21 of the 410 exploited Microsoft vulnerabilities tracked here are not in CISA KEV. Teams relying on the official catalog alone would miss 5% of this vendor portfolio.
- 95%
- Covered by CISA
- 5%
- Beyond CISA
- 211
- Product families
Attested Microsoft vulnerabilities
410 known exploited vulnerabilities in this exploited-vulnerability portfolio. Search, then narrow it to official CISA coverage or the additional records Previdian tracks beyond the catalog.
How exploitation is verified| CVE / description | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2018-8405
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX... |
Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2018-8406
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX... |
Windows Server 2016, Windows 10, Windows 10 Servers | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2018-8440
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC... |
Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2021-34486
Windows Event Tracing Elevation of Privilege Vulnerability |
Windows 10 Version 1809, Windows 10 Version 1909, Windows 10 Version 2004, Windows 10 Version 20H2, Windows 10 Version 21H1, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server version 2004, Windows Server version 20H2 | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2021-38646
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability |
Microsoft 365 Apps for Enterprise, Microsoft Office 2013 Service Pack 1, Microsoft Office 2016, Microsoft Office 2019 | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2021-34484
Windows User Profile Service Elevation of Privilege Vulnerability |
Windows 10 Version 1507, Windows 10 Version 1607, Windows 10 Version 1809, Windows 10 Version 1909, Windows 10 Version 2004, Windows 10 Version 20H2, Windows 10 Version 21H1, Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server version 2004, Windows Server version 20H2 | Confirmed | In CISA | 31 Mar 2022 |
|
CVE-2017-0148
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2;... |
Windows SMB | Confirmed | In CISA | 06 Apr 2022 |
|
CVE-2021-31166
HTTP Protocol Stack Remote Code Execution Vulnerability |
Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2 | Confirmed | In CISA | 06 Apr 2022 |
|
CVE-2021-42278
Active Directory Domain Services Elevation of Privilege Vulnerability |
Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server version 2004, Windows Server version 20H2 | Confirmed | In CISA | 11 Apr 2022 |
|
CVE-2021-42287
Active Directory Domain Services Elevation of Privilege Vulnerability |
Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation), Windows Server 2016, Windows Server 2016 (Server Core installation), Windows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server version 2004, Windows Server version 20H2 | Confirmed | In CISA | 11 Apr 2022 |
|
CVE-2015-2502
Microsoft Internet Explorer 7 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a... |
Internet Explorer | Confirmed | In CISA | 13 Apr 2022 |
|
CVE-2022-24521
Windows Common Log File System Driver Elevation of Privilege Vulnerability |
Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) | Confirmed | In CISA | 13 Apr 2022 |
|
CVE-2022-22718
Windows Print Spooler Elevation of Privilege Vulnerability |
Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) | Confirmed | In CISA | 19 Apr 2022 |
|
CVE-2021-40450
Win32k Elevation of Privilege Vulnerability |
Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2 | Confirmed | In CISA | 25 Apr 2022 |
|
CVE-2021-41357
Win32k Elevation of Privilege Vulnerability |
Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2 | Confirmed | In CISA | 25 Apr 2022 |
|
CVE-2022-21919
Windows User Profile Service Elevation of Privilege Vulnerability |
Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) | Confirmed | In CISA | 25 Apr 2022 |
|
CVE-2022-26904
Windows User Profile Service Elevation of Privilege Vulnerability |
Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) | Confirmed | In CISA | 25 Apr 2022 |
|
CVE-2014-0322
Use-after-free vulnerability in Microsoft Internet Explorer 9 and 10 allows remote attackers to execute arbitrary code via vectors involving... |
Internet Explorer | Confirmed | In CISA | 04 May 2022 |
|
CVE-2014-4113
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,... |
Windows | Confirmed | In CISA | 04 May 2022 |
|
CVE-2018-8589
An elevation of privilege vulnerability exists when Windows improperly handles calls to Win32k.sys, aka "Windows Win32k Elevation of Privilege... |
Windows Server 2008, Windows 7, Windows Server 2008 R2 | Confirmed | In CISA | 23 May 2022 |
|
CVE-2019-1130
An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links, aka 'Windows Elevation... |
Windows Server, Windows, Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation) | Confirmed | In CISA | 23 May 2022 |
|
CVE-2019-1385
An elevation of privilege vulnerability exists when the Windows AppX Deployment Extensions improperly performs privilege management, resulting in... |
Windows, Windows Server, Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation) | Confirmed | In CISA | 23 May 2022 |
|
CVE-2019-0880
A local elevation of privilege vulnerability exists in how splwow64.exe handles certain calls, aka 'Microsoft splwow64 Elevation of Privilege... |
Windows Server, Windows, Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation) | Confirmed | In CISA | 23 May 2022 |
|
CVE-2019-0703
An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information... |
Windows, Windows Server | Confirmed | In CISA | 23 May 2022 |
|
CVE-2019-0676
An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited... |
Internet Explorer 11, Internet Explorer 10 | Confirmed | In CISA | 23 May 2022 |
|
CVE-2020-0638
An elevation of privilege vulnerability exists in the way the Update Notification Manager handles files.To exploit this vulnerability, an attacker... |
Windows, Windows 10 Version 1903 for ARM64-based Systems, Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows Server, Windows Server, version 1903 (Server Core installation), Windows 10 Version 1909 for 32-bit Systems, Windows 10 Version 1909 for x64-based Systems, Windows Server, version 1909 (Server Core installation), Windows 10 Version 1909 for ARM64-based Systems | Confirmed | In CISA | 23 May 2022 |
|
CVE-2020-1027
An elevation of privilege vulnerability exists in the way that the Windows Kernel handles objects in memory, aka 'Windows Kernel Elevation of... |
Windows, Windows Server, Windows 10 Version 1909 for 32-bit Systems, Windows 10 Version 1909 for x64-based Systems, Windows 10 Version 1909 for ARM64-based Systems, Windows Server, version 1909 (Server Core installation), Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation) | Confirmed | In CISA | 23 May 2022 |
|
CVE-2016-3298
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1... |
Internet Explorer | Confirmed | In CISA | 24 May 2022 |
|
CVE-2016-3351
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka... |
Internet Explorer, Edge | Confirmed | In CISA | 24 May 2022 |
|
CVE-2016-0162
Microsoft Internet Explorer 9 through 11 allows remote attackers to determine the existence of files via crafted JavaScript code, aka "Internet... |
Internet Explorer | Confirmed | In CISA | 24 May 2022 |
|
CVE-2017-8543
Microsoft Windows XP SP3, Windows XP x64 XP2, Windows Server 2003 SP2, Windows Vista, Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8,... |
Microsoft Windows | Confirmed | In CISA | 24 May 2022 |
|
CVE-2017-0210
An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an... |
Internet Explorer | Confirmed | In CISA | 24 May 2022 |
|
CVE-2017-0149
Microsoft Internet Explorer 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a... |
Internet Explorer | Confirmed | In CISA | 24 May 2022 |
|
CVE-2017-0005
The Graphics Device Interface (GDI) in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server... |
Windows GDI | Confirmed | In CISA | 24 May 2022 |
|
CVE-2017-0022
Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2... |
XML Core Services | Confirmed | In CISA | 24 May 2022 |
|
CVE-2017-0147
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2;... |
Windows SMB | Confirmed | In CISA | 24 May 2022 |
|
CVE-2018-8611
An elevation of privilege vulnerability exists when the Windows kernel fails to properly handle objects in memory, aka "Windows Kernel Elevation of... |
Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers | Confirmed | In CISA | 24 May 2022 |
|
CVE-2013-0074
Microsoft Silverlight 5, and 5 Developer Runtime, before 5.1.20125.0 does not properly validate pointers during HTML object rendering, which allows... |
Silverlight | Confirmed | In CISA | 25 May 2022 |
|
CVE-2013-3896
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers... |
Silverlight | Confirmed | In CISA | 25 May 2022 |
|
CVE-2013-7331
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames,... |
Windows | Confirmed | In CISA | 25 May 2022 |
|
CVE-2014-4077
Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, and Office 2007 SP3, when IMJPDCT.EXE (aka... |
Windows | Confirmed | In CISA | 25 May 2022 |
|
CVE-2014-2817
Microsoft Internet Explorer 6 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of... |
Internet Explorer | Confirmed | In CISA | 25 May 2022 |
|
CVE-2014-4123
Microsoft Internet Explorer 7 through 11 allows remote attackers to gain privileges via a crafted web site, aka "Internet Explorer Elevation of... |
Internet Explorer | Confirmed | In CISA | 25 May 2022 |
|
CVE-2014-4148
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1,... |
Windows | Confirmed | In CISA | 25 May 2022 |
|
CVE-2015-1671
The Windows DirectWrite library, as used in Microsoft .NET Framework 3.0 SP2, 3.5, 3.5.1, 4, 4.5, 4.5.1, and 4.5.2; Office 2007 SP3 and 2010 SP2;... |
Windows DirectWrite | Confirmed | In CISA | 25 May 2022 |
|
CVE-2015-6175
The kernel in Microsoft Windows 10 Gold allows local users to gain privileges via a crafted application, aka "Windows Kernel Memory Elevation of... |
Windows 10 | Confirmed | In CISA | 25 May 2022 |
|
CVE-2015-1769
Mount Manager in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold... |
Windows | Confirmed | In CISA | 25 May 2022 |
|
CVE-2015-2425
Microsoft Internet Explorer 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web... |
Internet Explorer | Confirmed | In CISA | 25 May 2022 |
|
CVE-2015-2360
win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2 and R2 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1,... |
Windows | Confirmed | In CISA | 25 May 2022 |
|
CVE-2015-0071
Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the ASLR protection mechanism via a crafted web site, aka "Internet... |
Internet Explorer | Confirmed | In CISA | 25 May 2022 |
No Microsoft vulnerabilities match this search or filter.
Showing 50 of 50 on this page (410 Microsoft known exploited vulnerabilities).
Recurring weakness patterns
Out-of-bounds write, use after free, and link resolution before file access ('link following') account for 99 mapped occurrences across this Microsoft KEV portfolio.
CWE-787
Out-of-bounds Write
CWE-416
Use After Free
CWE-59
Improper Link Resolution Before File Access ('Link Following')
CWE-20
Improper Input Validation
CWE-119
Improper Restriction of Operations within the Bounds of a Memory Buffer
CWE-94
Improper Control of Generation of Code ('Code Injection')
CWE-502
Deserialization of Untrusted Data
CWE-122
Heap-based Buffer Overflow