Skip to content
eastbaycyber
KEV by vendor

Microsoft: CISA KEV History

Every Microsoft vulnerability in the CISA Known Exploited Vulnerabilities catalog: confirmed in-the-wild exploitation, addition timeline, and ransomware linkage. Rebuilt automatically on every site deploy.

Snapshot: 2026-09-08 · Source: CISA KEV Catalog · Full KEV dashboard

KEV entries
388
Added, last 12 months
48
Ransomware-linked
115
Latest addition
2026-09-08

Microsoft KEV additions per month, last 24 months

2024-10: 4 added424/102024-11: 2 added22024-12: 2 added22025-01: 3 added325/012025-02: 6 added62025-03: 7 added72025-04: 2 added225/042025-05: 5 added52025-06: 1 added12025-07: 3 added325/072025-08: 2 added22025-09: 0 added2025-10: 8 added825/102025-11: 1 added12025-12: 1 added12026-01: 3 added326/012026-02: 8 added82026-03: 1 added12026-04: 8 added826/042026-05: 7 added72026-06: 0 added2026-07: 5 added526/072026-08: 4 added42026-09: 2 added2

Most-listed products: Windows, Internet Explorer, Office, Win32k, Exchange Server.

Latest 50 of 388 Microsoft KEV entries

CVEVulnerabilityAddedRansomware
CVE-2026-81963Microsoft Windows Link Following Vulnerability2026-09-08No
CVE-2026-85880Microsoft Windows Heap-Based Buffer Overflow Vulnerability2026-09-08No
CVE-2019-1068Microsoft SQL Server Remote Code Execution Vulnerability2026-08-26No
CVE-2026-33824Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability2026-08-18No
CVE-2026-55040Microsoft SharePoint Weak Authentication Vulnerability2026-08-18No
CVE-2026-68820Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability2026-08-11No
CVE-2026-50522Microsoft SharePoint Deserialization of Untrusted Data Vulnerability 2026-07-22No
CVE-2026-58644Microsoft SharePoint Deserialization of Untrusted Data Vulnerability2026-07-16No
CVE-2026-56155Microsoft Active Directory Federation Services Insufficient Granularity of Access Control 2026-07-14No
CVE-2026-56164Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability2026-07-14No
CVE-2026-45659Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability2026-07-01Yes
CVE-2008-4250Microsoft Windows Buffer Overflow Vulnerability2026-05-20No
CVE-2009-1537Microsoft DirectX NULL Byte Overwrite Vulnerability2026-05-20No
CVE-2010-0249Microsoft Internet Explorer Use-After-Free Vulnerability2026-05-20No
CVE-2010-0806Microsoft Internet Explorer Use-After-Free Vulnerability2026-05-20No
CVE-2026-41091Microsoft Defender Link Following Vulnerability2026-05-20No
CVE-2026-45498Microsoft Defender Denial of Service Vulnerability2026-05-20No
CVE-2026-42897Microsoft Exchange Server Cross-Site Scripting Vulnerability2026-05-15No
CVE-2026-32202Microsoft Windows Protection Mechanism Failure Vulnerability2026-04-28No
CVE-2026-33825Microsoft Defender Insufficient Granularity of Access Control Vulnerability2026-04-22Yes
CVE-2009-0238Microsoft Office Remote Code Execution2026-04-14No
CVE-2026-32201Microsoft SharePoint Server Improper Input Validation Vulnerability2026-04-14No
CVE-2012-1854Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability2026-04-13No
CVE-2025-60710Microsoft Windows Link Following Vulnerability2026-04-13Yes
CVE-2023-21529Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability2026-04-13Yes
CVE-2023-36424Microsoft Windows Out-of-Bounds Read Vulnerability2026-04-13No
CVE-2026-20963Microsoft SharePoint Deserialization of Untrusted Data Vulnerability2026-03-18No
CVE-2008-0015 Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability2026-02-17No
CVE-2024-43468Microsoft Configuration Manager SQL Injection Vulnerability2026-02-12No
CVE-2026-21513Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability2026-02-10No
CVE-2026-21525Microsoft Windows NULL Pointer Dereference Vulnerability2026-02-10No
CVE-2026-21510Microsoft Windows Shell Protection Mechanism Failure Vulnerability2026-02-10No
CVE-2026-21533Microsoft Windows Improper Privilege Management Vulnerability2026-02-10No
CVE-2026-21519Microsoft Windows Type Confusion Vulnerability2026-02-10No
CVE-2026-21514Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability2026-02-10No
CVE-2026-21509Microsoft Office Security Feature Bypass Vulnerability2026-01-26No
CVE-2026-20805Microsoft Windows Information Disclosure Vulnerability2026-01-13No
CVE-2009-0556Microsoft Office PowerPoint Code Injection Vulnerability2026-01-07No
CVE-2025-62221Microsoft Windows Use After Free Vulnerability2025-12-09No
CVE-2025-62215Microsoft Windows Race Condition Vulnerability2025-11-12No
CVE-2025-59287Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerabi2025-10-24No
CVE-2025-33073Microsoft Windows SMB Client Improper Access Control Vulnerability2025-10-20No
CVE-2025-24990Microsoft Windows Untrusted Pointer Dereference Vulnerability2025-10-14No
CVE-2025-59230Microsoft Windows Improper Access Control Vulnerability2025-10-14No
CVE-2010-3962Microsoft Internet Explorer Uninitialized Memory Corruption Vulnerability2025-10-06No
CVE-2021-43226Microsoft Windows Privilege Escalation Vulnerability2025-10-06Yes
CVE-2013-3918Microsoft Windows Out-of-Bounds Write Vulnerability2025-10-06No
CVE-2011-3402Microsoft Windows Remote Code Execution Vulnerability2025-10-06No
CVE-2007-0671Microsoft Office Excel Remote Code Execution Vulnerability2025-08-12No
CVE-2013-3893Microsoft Internet Explorer Resource Management Errors Vulnerability2025-08-12No

CVE links go to our explainer when one exists, otherwise to the NVD record.

Data: official CISA KEV catalog, fetched at build time. Figures may be reused with attribution to East Bay Cyber and CISA. See also the KEV Velocity Dashboard and all tracked vendors.