Microsoft

› Microsoft Windows ✓patched

Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. CISA added CVE-2026-81963, CVE-2026-85880 to the Known Exploited Vulnerabilities catalog on 2026-09-08 based on evidence of active exploitation.

› Microsoft Internet Key Exchange (IKE) Service Extensions ✓patched

Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. Added to CISA KEV on 2026-08-18.

› Microsoft SharePoint ✓patched

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. Added to CISA KEV on 2026-08-18.

› Microsoft Windows Ancillary Function Driver for WinSock ✓patched

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA KEV on 2026-08-11.

› Microsoft SharePoint ✓patched

Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-07-22.

› Microsoft SharePoint ✓patched

Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-07-16.

› Microsoft Active Directory Federation Services ✓patched

Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA KEV on 2026-07-14.

› Microsoft SharePoint Server ✓patched

Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. Added to CISA KEV on 2026-07-14.

› Microsoft SharePoint Server ✓patched

Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. Added to CISA KEV on 2026-07-01.

› Microsoft Defender ✓patched

Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. CISA added CVE-2026-41091, CVE-2026-45498 to the Known Exploited Vulnerabilities catalog on 2026-05-20 based on evidence of active exploitation.

› Microsoft Microsoft ✓patched

Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. Added to CISA KEV on 2026-05-15.

› Microsoft Windows ✓patched

Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-04-28.

› Microsoft Defender ✓patched

Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. Added to CISA KEV on 2026-04-22.

› Microsoft SharePoint Server ✓patched

Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-04-14.

› Microsoft Windows ✓patched

Microsoft Windows contains a link following vulnerability that allows for privilege escalation CISA added CVE-2025-60710, CVE-2023-36424 to the Known Exploited Vulnerabilities catalog on 2026-04-13 based on evidence of active exploitation.

› Microsoft SharePoint ✓patched

Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-03-18.

› Stryker corporate Microsoft / endpoint environment –no fix needed

In March 2026 medical-tech company Stryker suffered a disruptive attack on its Microsoft environment. Iran-linked Handala claimed responsibility, alleging mass device wipes after domain-admin compromise. CISA warned organizations to harden endpoint management. Stryker reported being fully operational by early April.

› Microsoft Office ✓patched

Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally. Added to CISA KEV on 2026-02-10.

› Microsoft Windows ✓patched

Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. CISA added CVE-2026-21513, CVE-2026-21525, CVE-2026-21510, CVE-2026-21533, CVE-2026-21519 to the Known Exploited Vulnerabilities catalog on 2026-02-10 based on evidence of active exploitation.

› Microsoft Office ✓patched

Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Added to CISA KEV on 2026-01-26.

› Microsoft Windows ✓patched

Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally. Added to CISA KEV on 2026-01-13.