Microsoft
390 Microsoft flaws are on CISA's list of vulnerabilities attackers have used, 40 of them added in 2026. CISA says 117 are known to be used by ransomware. The latest was added Oct 13, 2026.
390on CISA's list, all time
40added in 2026
8in the last 90 days
117used by ransomware
102zero-days, all time
Exploited flaws added each year
Most-hit products
| Product | Exploited flaws | Most recent |
|---|---|---|
| Windows | 173 | Oct 13, 2026 |
| Internet Explorer | 36 | May 20, 2026 |
| Office | 29 | Apr 14, 2026 |
| Win32k | 25 | Jun 22, 2023 |
| Exchange Server | 17 | Apr 13, 2026 |
| SharePoint | 10 | Sep 25, 2026 |
| SharePoint Server | 5 | Jul 14, 2026 |
| Defender | 5 | May 20, 2026 |
| Word | 4 | Sep 12, 2023 |
| Open Management Infrastructure (OMI) | 4 | Nov 3, 2021 |
Latest Microsoft flaws
- WindowsMicrosoft Windows Command Injection Vulnerability
- SharePointMicrosoft SharePoint Code Injection Vulnerability
- WindowsMicrosoft Windows Link Following Vulnerability
- WindowsMicrosoft Windows Heap-Based Buffer Overflow Vulnerability
- SQL ServerMicrosoft SQL Server Remote Code Execution Vulnerability
- Internet Key Exchange (IKE) Service ExtensionsMicrosoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
- SharePointMicrosoft SharePoint Weak Authentication Vulnerability
- Windows Ancillary Function Driver for WinSock Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
- SharePointMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability
- SharePointMicrosoft SharePoint Deserialization of Untrusted Data Vulnerability
- Active Directory Federation ServicesMicrosoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
- SharePoint ServerMicrosoft SharePoint Server Missing Authentication for Critical Function Vulnerability
- SharePoint ServerMicrosoft SharePoint Server Deserialization of Untrusted Data Vulnerability
- WindowsMicrosoft Windows Buffer Overflow Vulnerability
- DirectXMicrosoft DirectX NULL Byte Overwrite Vulnerability
Counts come from CISA's Known Exploited Vulnerabilities catalog, which lists flaws with reliable evidence of real attacks. A higher count often reflects how widely a vendor's products are used and targeted, not only how secure they are.