Short answer: this page lists every Microsoft vulnerability that CISA added to its Known Exploited Vulnerabilities (KEV) catalog in 2026, meaning there is evidence of exploitation in the wild, with the fix and a link to our Daily Brief coverage where we wrote about it. If you run any product in the table, treat its row as a patch-now item.
How to use this page
- Match products first. Compare the Product column with your asset inventory. Only rows for products and versions you run matter to you.
- Patch newest and internet-facing first. Rows are sorted by the date CISA added them. Recently added flaws on exposed systems are usually the most urgent.
- Use the Fix column. It shows CISA’s required action and links to Microsoft’s advisory (or the NVD entry when CISA lists no advisory) for fixed versions and workarounds.
- Check for compromise, not just patch status. Where we covered a flaw, the Our coverage link has exposure checks and what to hunt for. Patching does not remove an attacker who is already in.
- U.S. federal agencies must remediate KEV entries by the due date CISA sets; everyone else can use KEV as a priority list.
Microsoft vulnerabilities exploited in 2026
As of 2026-10-08 (CISA KEV catalog version 2026.10.08), CISA lists 39 Microsoft vulnerabilities added to the Known Exploited Vulnerabilities catalog in 2026. CyberExperts has covered 13 of them in the Daily Brief. Newest additions are first.
| CVE | Product | Added to KEV | Fix | Our coverage |
|---|---|---|---|---|
| CVE-2026-65660 | SharePoint Microsoft SharePoint Code Injection Vulnerability | 2026-09-25 | Apply the vendor's updates or mitigations. Vendor advisory | Monday’s brief: NetScaler zero-days, then SharePoint’s deadline, Zimbra OnlyOffice, and a WSO2 JWT bypass SharePoint’s federal clock runs out today — confirm the August builds |
| CVE-2026-85880 | Windows Microsoft Windows Heap-Based Buffer Overflow Vulnerability | 2026-09-08 | Apply the vendor's updates or mitigations. Vendor advisory | BlueMoon: Four Espionage Groups Share One Chrome-to-SYSTEM Exploit Kit Windows Update Stack CVE-2026-81963: The Link-Following Zero-Day That Finishes the Job The 5-Minute Cyber Brief: September 10, 2026 |
| CVE-2026-81963 | Windows Microsoft Windows Link Following Vulnerability | 2026-09-08 | Apply the vendor's updates or mitigations. Vendor advisory | Windows Update Stack CVE-2026-81963: The Link-Following Zero-Day That Finishes the Job The 5-Minute Cyber Brief: September 10, 2026 Windows ALPC Heap Overflow CVE-2026-85880: AppContainer to SYSTEM Zero-Day (Not the Update Stack Bug) |
| CVE-2019-1068 | SQL Server Microsoft SQL Server Remote Code Execution Vulnerability | 2026-08-26 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-55040 | SharePoint Microsoft SharePoint Weak Authentication Vulnerability | 2026-08-18 | Apply the vendor's updates or mitigations. Vendor advisory | Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days The 5-Minute Cyber Brief: August 12, 2026 Researchers Disclose AI-Assisted SharePoint Exploit Chain Reaching Unauthenticated RCE |
| CVE-2026-33824 | Internet Key Exchange (IKE) Service Extensions Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability | 2026-08-18 | Apply the vendor's updates or mitigations. Vendor advisory | Critical macOS, SharePoint, vCenter, and Microsoft IKE Flaws Under Active Exploitation |
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability | 2026-08-11 | Apply the vendor's updates or mitigations. Vendor advisory | Microsoft August 2026 Patch Tuesday fixes 400 flaws, 3 zero-days CISA Adds Three Known Exploited Vulnerabilities to Catalog The 5-Minute Cyber Brief: August 12, 2026 |
| CVE-2026-50522 | SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 2026-07-22 | Apply the vendor's updates or mitigations. Vendor advisory | CISA Adds Two Known Exploited Vulnerabilities to Catalog The 5-Minute Cyber Brief: July 22, 2026 The 5-Minute Cyber Brief: July 23, 2026 |
| CVE-2026-58644 | SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 2026-07-16 | Apply the vendor's updates or mitigations. Vendor advisory | The 5-Minute Cyber Brief: July 22, 2026 Attackers Exploit SharePoint Authentication Bypass After Public PoC Release |
| CVE-2026-56164 | SharePoint Server Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability | 2026-07-14 | Apply the vendor's updates or mitigations. Vendor advisory | The 5-Minute Cyber Brief: July 22, 2026 The 5-Minute Cyber Brief: July 23, 2026 The 5-Minute Cyber Brief: July 24, 2026 |
| CVE-2026-56155 | Active Directory Federation Services Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability | 2026-07-14 | Apply the vendor's updates or mitigations. Vendor advisory | The 5-Minute Cyber Brief: July 22, 2026 The 5-Minute Cyber Brief: July 23, 2026 The 5-Minute Cyber Brief: July 24, 2026 |
| CVE-2026-45659 | SharePoint Server Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability (known ransomware use) | 2026-07-01 | Apply the vendor's updates or mitigations. Vendor advisory | The 5-Minute Cyber Brief: August 11, 2026 CISA: Microsoft SharePoint flaw now exploited in ransomware attacks Attackers Exploit SharePoint Authentication Bypass After Public PoC Release |
| CVE-2026-45498 | Defender Microsoft Defender Denial of Service Vulnerability | 2026-05-20 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-41091 | Defender Microsoft Defender Link Following Vulnerability | 2026-05-20 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2010-0806 | Internet Explorer Microsoft Internet Explorer Use-After-Free Vulnerability | 2026-05-20 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2010-0249 | Internet Explorer Microsoft Internet Explorer Use-After-Free Vulnerability | 2026-05-20 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2009-1537 | DirectX Microsoft DirectX NULL Byte Overwrite Vulnerability | 2026-05-20 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2008-4250 | Windows Microsoft Windows Buffer Overflow Vulnerability | 2026-05-20 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-42897 | Microsoft Microsoft Exchange Server Cross-Site Scripting Vulnerability | 2026-05-15 | Apply the vendor's updates or mitigations. Vendor advisory | Nearly 22,000 Microsoft Exchange servers vulnerable to hijack attacks |
| CVE-2026-32202 | Windows Microsoft Windows Protection Mechanism Failure Vulnerability | 2026-04-28 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-33825 | Defender Microsoft Defender Insufficient Granularity of Access Control Vulnerability (known ransomware use) | 2026-04-22 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-32201 | SharePoint Server Microsoft SharePoint Server Improper Input Validation Vulnerability | 2026-04-14 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2009-0238 | Office Microsoft Office Remote Code Execution | 2026-04-14 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2025-60710 | Windows Microsoft Windows Link Following Vulnerability (known ransomware use) | 2026-04-13 | Apply the vendor's updates or mitigations. Vendor advisory | CISA: Windows Task Host flaw now exploited by ransomware gangs The 5-Minute Cyber Brief: August 19, 2026 |
| CVE-2023-36424 | Windows Microsoft Windows Out-of-Bounds Read Vulnerability | 2026-04-13 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2023-21529 | Exchange Server Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability (known ransomware use) | 2026-04-13 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2012-1854 | Visual Basic for Applications (VBA) Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability | 2026-04-13 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-20963 | SharePoint Microsoft SharePoint Deserialization of Untrusted Data Vulnerability | 2026-03-18 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2008-0015 | Windows Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability | 2026-02-17 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2024-43468 | Configuration Manager Microsoft Configuration Manager SQL Injection Vulnerability | 2026-02-12 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-21533 | Windows Microsoft Windows Improper Privilege Management Vulnerability | 2026-02-10 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-21525 | Windows Microsoft Windows NULL Pointer Dereference Vulnerability | 2026-02-10 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-21519 | Windows Microsoft Windows Type Confusion Vulnerability | 2026-02-10 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-21514 | Office Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability | 2026-02-10 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-21513 | Windows Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability | 2026-02-10 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-21510 | Windows Microsoft Windows Shell Protection Mechanism Failure Vulnerability | 2026-02-10 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-21509 | Office Microsoft Office Security Feature Bypass Vulnerability | 2026-01-26 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2026-20805 | Windows Microsoft Windows Information Disclosure Vulnerability | 2026-01-13 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
| CVE-2009-0556 | Office Microsoft Office PowerPoint Code Injection Vulnerability | 2026-01-07 | Apply the vendor's updates or mitigations. Vendor advisory | Not covered yet |
How this page is built
The table is compiled from CISA’s Known Exploited Vulnerabilities catalog and our own Daily Brief coverage, and we refresh it as CISA adds entries. A missing row means CISA has not added that flaw to KEV this year, not that it is safe to ignore. Always confirm fixed versions in the vendor advisory.