Microsoft Known Exploited Vulnerabilities
Evidence-backed KEV intelligence for Microsoft products — CISA KEV status, confidence, sensor telemetry, and virtual-patch availability.
Total KEVs
403
In CISA KEV
383
Beyond CISA KEV
20
Sensor Observed
3
Virtual Patch Available
0
Microsoft KEVs Added by Year
403 Microsoft KEVs added all time (primary attestation date).
Attested CVEs
| CVE | Product | Confidence | CISA KEV | Added |
|---|---|---|---|---|
|
CVE-2019-0903
A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+... |
Windows, Windows Server, Windows 10 Version 1903 for 32-bit Systems, Windows 10 Version 1903 for x64-based Systems, Windows 10 Version 1903 for ARM64-based Systems, Windows Server, version 1903 (Server Core installation) | Confirmed | In CISA | 25 Mar 2022 |
|
CVE-2022-21999
Windows Print Spooler Elevation of Privilege Vulnerability |
Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows Server 2022, Windows 10 Version 20H2, Windows Server version 20H2, Windows 11 version 21H2, Windows 10 Version 21H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) | Confirmed | In CISA | 25 Mar 2022 |
|
CVE-2010-4398
Stack-based buffer overflow in the RtlQueryRegistryValues function in win32k.sys in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2,... |
Windows | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2011-2005
afd.sys in the Ancillary Function Driver in Microsoft Windows XP SP2 and SP3 and Server 2003 SP2 does not properly validate user-mode input passed... |
Windows | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2012-2539
Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow... |
Word | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2013-2551
Use-after-free vulnerability in Microsoft Internet Explorer 6 through 10 allows remote attackers to execute arbitrary code via a crafted web site... |
Internet Explorer | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2013-3660
The EPATHOBJ::pprFlattenRec function in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows... |
Windows | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2015-1770
Microsoft Office 2013 SP1 and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office... |
Office 2013 | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2015-2419
JScript 9 in Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory... |
Internet Explorer | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2015-2426
Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows... |
Windows | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2016-0040
The kernel in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allows local users to gain privileges via a... |
Windows | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2016-0151
The Client-Server Run-time Subsystem (CSRSS) in Microsoft Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold and... |
Windows | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2016-0189
The Microsoft (1) JScript 5.8 and (2) VBScript 5.7 and 5.8 engines, as used in Internet Explorer 9 through 11 and other products, allow remote... |
Internet Explorer | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2016-7200
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory... |
Edge | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2016-7201
The Chakra JavaScript scripting engine in Microsoft Edge allows remote attackers to execute arbitrary code or cause a denial of service (memory... |
Edge | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2017-0037
Microsoft Internet Explorer 10 and 11 and Microsoft Edge have a type confusion issue in the... |
Internet Browser | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2017-0059
Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka... |
Internet Explorer | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2017-0213
Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2,... |
Windows COM | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2018-8405
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX... |
Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2018-8406
An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX... |
Windows Server 2016, Windows 10, Windows 10 Servers | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2018-8440
An elevation of privilege vulnerability exists when Windows improperly handles calls to Advanced Local Procedure Call (ALPC), aka "Windows ALPC... |
Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2021-34486
Windows Event Tracing Elevation of Privilege Vulnerability |
Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2 | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2021-38646
Microsoft Office Access Connectivity Engine Remote Code Execution Vulnerability |
Microsoft Office 2019, Microsoft 365 Apps for Enterprise, Microsoft Office 2016, Microsoft Office 2013 Service Pack 1 | Confirmed | In CISA | 28 Mar 2022 |
|
CVE-2021-34484
Windows User Profile Service Elevation of Privilege Vulnerability |
Windows 10 Version 1809, Windows Server 2019, Windows Server 2019 (Server Core installation), Windows 10 Version 1909, Windows 10 Version 21H1, Windows 10 Version 2004, Windows Server version 2004, Windows 10 Version 20H2, Windows Server version 20H2, Windows 10 Version 1507, Windows 10 Version 1607, Windows Server 2016, Windows Server 2016 (Server Core installation), Windows 7, Windows 7 Service Pack 1, Windows 8.1, Windows Server 2008 Service Pack 2, Windows Server 2008 Service Pack 2 (Server Core installation), Windows Server 2008 Service Pack 2, Windows Server 2008 R2 Service Pack 1, Windows Server 2008 R2 Service Pack 1 (Server Core installation), Windows Server 2012, Windows Server 2012 (Server Core installation), Windows Server 2012 R2, Windows Server 2012 R2 (Server Core installation) | Confirmed | In CISA | 31 Mar 2022 |
|
CVE-2017-0148
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2;... |
Windows SMB | Confirmed | In CISA | 06 Apr 2022 |
Common Vulnerability Classes (CWE)
- CWE-787 — Out-of-bounds Write 45
- CWE-416 — Use After Free 34
- CWE-59 — Improper Link Resolution Before File Access ('Link Following') 18
- CWE-20 — Improper Input Validation 16
- CWE-119 — Improper Restriction of Operations within the Bounds of a Memory Buffer 16
- CWE-94 — Improper Control of Generation of Code ('Code Injection') 14
- CWE-502 — Deserialization of Untrusted Data 13
- CWE-269 — Improper Privilege Management 9
Browse all known exploited vulnerabilities · What is a known exploited vulnerability? · Methodology