{ "site": "https://pwn.watch", "generatedAt": "2026-10-22T17:32:17.031Z", "tag": { "id": "microsoft", "label": "Microsoft", "isStack": false, "url": "https://pwn.watch/t/microsoft", "feed": "https://pwn.watch/t/microsoft/feed.xml" }, "counts": { "incidents": 93, "live": 1, "notFullyPatched": 1, "patched": 91 }, "incidents": [ { "slug": "connectwise-cloud-backup-m365-hijack", "title": "ConnectWise Cloud Backup shut down after M365 app-identity hijack", "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack", "json": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack.json", "status": "live", "severity": "critical", "patchStatus": "partial", "product": "ConnectWise Cloud Backup / Microsoft 365 app identity", "tags": [ "connectwise", "microsoft", "microsoft-365" ], "cveIds": [], "affectedVersions": [ "Cloud Backup service (shut down)" ], "fixedVersions": [], "startedAt": "2026-10-17", "closedAt": null, "updatedAt": "2026-10-22T19:14:54+02:00", "summary": "ConnectWise disabled Cloud Backup after a compromised credential let attackers authenticate as the application and sign in to at least 173 customer Microsoft 365 tenants.", "xPost": null }, { "slug": "windows-shell-cve-2026-96951-motw", "title": "Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)", "url": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw", "json": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows Shell (and related Oct Patch Tuesday components)", "tags": [ "microsoft", "windows", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2026-96951", "CVE-2026-108398", "CVE-2026-92707" ], "affectedVersions": [ "Supported Windows versions receiving the October 2026 cumulative updates (see Microsoft Security Update Guide)" ], "fixedVersions": [ "October 2026 Patch Tuesday cumulative updates (KB packages per SKU)" ], "startedAt": "2026-10-13", "closedAt": "2026-10-13", "updatedAt": "2026-10-22T11:20:00+02:00", "summary": "Microsoft’s October 13 2026 Patch Tuesday fixed an actively exploited Windows Shell security-feature bypass, CVE-2026-96951, that can evade Mark of the Web protections (command-injection style neutralization flaw). CISA added it to KEV. Two other publicly disclosed zero-days (.NET Framework WDAC bypass CVE-2026-108398 and MessagePack-CSharp DoS CVE-2026-92707) shipped in the same release.", "xPost": null }, { "slug": "microsoft-sharepoint-cve-2026-65660", "title": "Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660", "json": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint", "tags": [ "microsoft", "sharepoint", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-65660" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-25", "closedAt": "2026-09-25", "updatedAt": "2026-09-25", "summary": "Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network. Added to CISA KEV on 2026-09-25.", "xPost": null }, { "slug": "microsoft-windows-cve-2026-81963", "title": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2026-81963", "json": "https://pwn.watch/i/microsoft-windows-cve-2026-81963.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2026-81963", "CVE-2026-85880" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-09-08", "closedAt": "2026-09-08", "updatedAt": "2026-09-08", "summary": "Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM. CISA added CVE-2026-81963, CVE-2026-85880 to the Known Exploited Vulnerabilities catalog on 2026-09-08 based on evidence of active exploitation.", "xPost": null }, { "slug": "microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824", "title": "Microsoft Internet Key Exchange (IKE) Service Extensions: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability", "url": "https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824", "json": "https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Internet Key Exchange (IKE) Service Extensions", "tags": [ "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2026-33824" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-18", "closedAt": "2026-08-18", "updatedAt": "2026-08-18", "summary": "Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution. Added to CISA KEV on 2026-08-18.", "xPost": null }, { "slug": "microsoft-sharepoint-cve-2026-55040", "title": "Microsoft SharePoint: Microsoft SharePoint Weak Authentication Vulnerability", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040", "json": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint", "tags": [ "microsoft", "sharepoint", "cisa-kev" ], "cveIds": [ "CVE-2026-55040" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-18", "closedAt": "2026-08-18", "updatedAt": "2026-08-18", "summary": "Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network. Added to CISA KEV on 2026-08-18.", "xPost": null }, { "slug": "microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820", "title": "Microsoft Windows Ancillary Function Driver for WinSock : Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820", "json": "https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows Ancillary Function Driver for WinSock ", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2026-68820" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-08-11", "closedAt": "2026-08-11", "updatedAt": "2026-08-11", "summary": "Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA KEV on 2026-08-11.", "xPost": null }, { "slug": "microsoft-sharepoint-cve-2026-50522", "title": "Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522", "json": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint", "tags": [ "microsoft", "sharepoint", "cisa-kev" ], "cveIds": [ "CVE-2026-50522" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-22", "closedAt": "2026-07-22", "updatedAt": "2026-07-22", "summary": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-07-22.", "xPost": null }, { "slug": "microsoft-sharepoint-cve-2026-58644", "title": "Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644", "json": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint", "tags": [ "microsoft", "sharepoint", "cisa-kev" ], "cveIds": [ "CVE-2026-58644" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-16", "closedAt": "2026-07-16", "updatedAt": "2026-07-16", "summary": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-07-16.", "xPost": null }, { "slug": "microsoft-active-directory-federation-services-cve-2026-56155", "title": "Microsoft Active Directory Federation Services: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ", "url": "https://pwn.watch/i/microsoft-active-directory-federation-services-cve-2026-56155", "json": "https://pwn.watch/i/microsoft-active-directory-federation-services-cve-2026-56155.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Active Directory Federation Services", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2026-56155" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-14", "closedAt": "2026-07-14", "updatedAt": "2026-07-14", "summary": "Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA KEV on 2026-07-14.", "xPost": null }, { "slug": "microsoft-sharepoint-server-cve-2026-56164", "title": "Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164", "json": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint Server", "tags": [ "microsoft", "sharepoint", "cisa-kev", "auth-bypass" ], "cveIds": [ "CVE-2026-56164" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-14", "closedAt": "2026-07-14", "updatedAt": "2026-07-14", "summary": "Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network. Added to CISA KEV on 2026-07-14.", "xPost": null }, { "slug": "microsoft-sharepoint-server-cve-2026-45659", "title": "Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659", "json": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint Server", "tags": [ "microsoft", "sharepoint", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-45659" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-07-01", "closedAt": "2026-07-01", "updatedAt": "2026-07-01", "summary": "Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network. Added to CISA KEV on 2026-07-01.", "xPost": null }, { "slug": "microsoft-defender-cve-2026-41091", "title": "Microsoft Defender: Microsoft Defender Link Following Vulnerability", "url": "https://pwn.watch/i/microsoft-defender-cve-2026-41091", "json": "https://pwn.watch/i/microsoft-defender-cve-2026-41091.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Defender", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2026-41091", "CVE-2026-45498" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-20", "closedAt": "2026-05-20", "updatedAt": "2026-05-20", "summary": "Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally. CISA added CVE-2026-41091, CVE-2026-45498 to the Known Exploited Vulnerabilities catalog on 2026-05-20 based on evidence of active exploitation.", "xPost": null }, { "slug": "microsoft-microsoft-cve-2026-42897", "title": "Microsoft Microsoft: Microsoft Exchange Server Cross-Site Scripting Vulnerability", "url": "https://pwn.watch/i/microsoft-microsoft-cve-2026-42897", "json": "https://pwn.watch/i/microsoft-microsoft-cve-2026-42897.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Microsoft", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2026-42897" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-05-15", "closedAt": "2026-05-15", "updatedAt": "2026-05-15", "summary": "Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context. Added to CISA KEV on 2026-05-15.", "xPost": null }, { "slug": "microsoft-windows-cve-2026-32202", "title": "Microsoft Windows: Microsoft Windows Protection Mechanism Failure Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2026-32202", "json": "https://pwn.watch/i/microsoft-windows-cve-2026-32202.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2026-32202" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-28", "closedAt": "2026-04-28", "updatedAt": "2026-04-28", "summary": "Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-04-28.", "xPost": null }, { "slug": "microsoft-defender-cve-2026-33825", "title": "Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability", "url": "https://pwn.watch/i/microsoft-defender-cve-2026-33825", "json": "https://pwn.watch/i/microsoft-defender-cve-2026-33825.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Defender", "tags": [ "microsoft", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2026-33825" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-22", "closedAt": "2026-04-22", "updatedAt": "2026-04-22", "summary": "Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally. Added to CISA KEV on 2026-04-22.", "xPost": null }, { "slug": "microsoft-sharepoint-server-cve-2026-32201", "title": "Microsoft SharePoint Server: Microsoft SharePoint Server Improper Input Validation Vulnerability", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201", "json": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint Server", "tags": [ "microsoft", "sharepoint", "cisa-kev" ], "cveIds": [ "CVE-2026-32201" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-14", "closedAt": "2026-04-14", "updatedAt": "2026-04-14", "summary": "Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2026-04-14.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-60710", "title": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-60710", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-60710.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-60710", "CVE-2023-36424" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-04-13", "closedAt": "2026-04-13", "updatedAt": "2026-04-13", "summary": "Microsoft Windows contains a link following vulnerability that allows for privilege escalation CISA added CVE-2025-60710, CVE-2023-36424 to the Known Exploited Vulnerabilities catalog on 2026-04-13 based on evidence of active exploitation.", "xPost": null }, { "slug": "microsoft-sharepoint-cve-2026-20963", "title": "Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963", "json": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint", "tags": [ "microsoft", "sharepoint", "cisa-kev" ], "cveIds": [ "CVE-2026-20963" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-03-18", "closedAt": "2026-03-18", "updatedAt": "2026-03-18", "summary": "Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network. Added to CISA KEV on 2026-03-18.", "xPost": null }, { "slug": "stryker-handala-wiper-march", "title": "Stryker hit by Handala data-wiping attack", "url": "https://pwn.watch/i/stryker-handala-wiper-march", "json": "https://pwn.watch/i/stryker-handala-wiper-march.json", "status": "closed", "severity": "unknown", "patchStatus": "no-fix-needed", "product": "Stryker corporate Microsoft / endpoint environment", "tags": [ "microsoft", "stryker", "wiper" ], "cveIds": [], "affectedVersions": [ "n/a" ], "fixedVersions": [], "startedAt": "2026-03-12", "closedAt": "2026-04-05", "updatedAt": "2026-04-05", "summary": "In March 2026 medical-tech company Stryker suffered a disruptive attack on its Microsoft environment. Iran-linked Handala claimed responsibility, alleging mass device wipes after domain-admin compromise. CISA warned organizations to harden endpoint management. Stryker reported being fully operational by early April.", "xPost": null }, { "slug": "microsoft-office-cve-2026-21514", "title": "Microsoft Office: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability", "url": "https://pwn.watch/i/microsoft-office-cve-2026-21514", "json": "https://pwn.watch/i/microsoft-office-cve-2026-21514.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Office", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2026-21514" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-10", "closedAt": "2026-02-10", "updatedAt": "2026-02-10", "summary": "Microsoft Office Word contains a reliance on untrusted inputs in a security decision vulnerability that could allow an authorized attacker to elevate privileges locally. Added to CISA KEV on 2026-02-10.", "xPost": null }, { "slug": "microsoft-windows-cve-2026-21513", "title": "Microsoft Windows: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2026-21513", "json": "https://pwn.watch/i/microsoft-windows-cve-2026-21513.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2026-21513", "CVE-2026-21525", "CVE-2026-21510", "CVE-2026-21533", "CVE-2026-21519" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-02-10", "closedAt": "2026-02-10", "updatedAt": "2026-02-10", "summary": "Microsoft MSHTML Framework contains a protection mechanism failure vulnerability that could allow an unauthorized attacker to bypass a security feature over a network. CISA added CVE-2026-21513, CVE-2026-21525, CVE-2026-21510, CVE-2026-21533, CVE-2026-21519 to the Known Exploited Vulnerabilities catalog on 2026-02-10 based on evidence of active exploitation.", "xPost": null }, { "slug": "microsoft-office-cve-2026-21509", "title": "Microsoft Office: Microsoft Office Security Feature Bypass Vulnerability", "url": "https://pwn.watch/i/microsoft-office-cve-2026-21509", "json": "https://pwn.watch/i/microsoft-office-cve-2026-21509.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Office", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2026-21509" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-01-26", "closedAt": "2026-01-26", "updatedAt": "2026-01-26", "summary": "Microsoft Office contains a security feature bypass vulnerability in which reliance on untrusted inputs in a security decision in Microsoft Office could allow an unauthorized attacker to bypass a security feature locally. Some of the impacted product(s) could be end-of-life (EoL) and/or end-of-service (EoS). Users are advised to discontinue use and/or transition to a supported version. Added to CISA KEV on 2026-01-26.", "xPost": null }, { "slug": "microsoft-windows-cve-2026-20805", "title": "Microsoft Windows: Microsoft Windows Information Disclosure Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2026-20805", "json": "https://pwn.watch/i/microsoft-windows-cve-2026-20805.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2026-20805" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2026-01-13", "closedAt": "2026-01-13", "updatedAt": "2026-01-13", "summary": "Microsoft Windows Desktop Windows Manager contains an information disclosure vulnerability that allows an authorized attacker to disclose information locally. Added to CISA KEV on 2026-01-13.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-62221", "title": "Microsoft Windows: Windows Use After Free Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-62221", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-62221.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-62221" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-12-09", "closedAt": "2025-12-09", "updatedAt": "2025-12-09", "summary": "Microsoft Windows Cloud Files Mini Filter Driver contains a use after free vulnerability that can allow an authorized attacker to elevate privileges locally. Added to CISA KEV on 2025-12-09.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-62215", "title": "Microsoft Windows: Windows Race Condition Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-62215", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-62215.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-62215" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-11-12", "closedAt": "2025-11-12", "updatedAt": "2025-11-12", "summary": "Microsoft Windows Kernel contains a race condition vulnerability that allows a local attacker with low-level privileges to escalate privileges. Successful exploitation of this vulnerability could enable the attacker to gain SYSTEM-level access. Added to CISA KEV on 2025-11-12.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-59287", "title": "Microsoft Windows: Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-59287", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-59287.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "rce" ], "cveIds": [ "CVE-2025-59287" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-24", "closedAt": "2025-10-24", "updatedAt": "2025-10-24", "summary": "Microsoft Windows Server Update Service (WSUS) contains a deserialization of untrusted data vulnerability that allows for remote code execution. Added to CISA KEV on 2025-10-24.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-33073", "title": "Microsoft Windows: Windows SMB Client Improper Access Control Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-33073", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-33073.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-33073" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-20", "closedAt": "2025-10-20", "updatedAt": "2025-10-20", "summary": "Microsoft Windows SMB Client contains an improper access control vulnerability that could allow for privilege escalation. An attacker could execute a specially crafted malicious script to coerce the victim machine to connect back to the attack system using SMB and authenticate. Added to CISA KEV on 2025-10-20.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-24990", "title": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-24990, CVE-2025-59230)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24990", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-24990.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-24990", "CVE-2025-59230" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-14", "closedAt": "2025-10-14", "updatedAt": "2025-10-14", "summary": "CVE-2025-24990: Microsoft Windows Agere Modem Driver contains an untrusted pointer dereference vulnerability that allows for privilege escalation. An attacker who successfully exploited this vulnerability could gain administrator privileges. CVE-2025-59230: Microsoft Windows contains an improper access control vulnerability in Windows Remote Access Connection Manager which could allow an authorized attacker to elevate privileges locally. Added to CISA KEV on 2025-10-14.", "xPost": null }, { "slug": "microsoft-windows-cve-2011-3402", "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402", "json": "https://pwn.watch/i/microsoft-windows-cve-2011-3402.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2011-3402", "CVE-2013-3918", "CVE-2021-43226" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-06", "closedAt": "2025-10-06", "updatedAt": "2025-10-06", "summary": "CVE-2011-3402: Microsoft Windows Kernel contains an unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers that allows remote attackers to execute arbitrary code via crafted font data in a Word document or web page. CVE-2013-3918: Microsoft Windows contains an out-of-bounds write vulnerability in the InformationCardSigninHelper Class ActiveX control, icardie.dll. An attacker could exploit the vulnerability by constructing a specially crafted webpage. When a user views the webpage, the vulnerability could allow remote code execution. An attacker who successfully exploited this vulnerability could gain the same user rights as the current user. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. CVE-2021-43226: Microsoft Windows Common Log File System Driver contains a privilege escalation vulnerability that could allow a local, privileged attacker to bypass certain security mechanisms. Added to CISA KEV on 2025-10-06.", "xPost": null }, { "slug": "microsoft-internet-explorer-cve-2010-3962", "title": "Microsoft Internet Explorer: Internet Explorer Uninitialized Memory Corruption Vulnerability", "url": "https://pwn.watch/i/microsoft-internet-explorer-cve-2010-3962", "json": "https://pwn.watch/i/microsoft-internet-explorer-cve-2010-3962.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Internet Explorer", "tags": [ "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2010-3962" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-10-06", "closedAt": "2025-10-06", "updatedAt": "2025-10-06", "summary": "Microsoft Internet Explorer contains an uninitialized memory corruption vulnerability that could allow for remote code execution. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-10-06.", "xPost": null }, { "slug": "microsoft-internet-explorer-cve-2013-3893", "title": "Microsoft Internet Explorer: Internet Explorer Resource Management Errors Vulnerability", "url": "https://pwn.watch/i/microsoft-internet-explorer-cve-2013-3893", "json": "https://pwn.watch/i/microsoft-internet-explorer-cve-2013-3893.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Internet Explorer", "tags": [ "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2013-3893" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-12", "closedAt": "2025-08-12", "updatedAt": "2025-08-12", "summary": "Microsoft Internet Explorer contains a memory corruption vulnerability that allows for remote code execution. The impacted products could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization. Added to CISA KEV on 2025-08-12.", "xPost": null }, { "slug": "microsoft-office-cve-2007-0671", "title": "Microsoft Office: Office Excel Remote Code Execution Vulnerability", "url": "https://pwn.watch/i/microsoft-office-cve-2007-0671", "json": "https://pwn.watch/i/microsoft-office-cve-2007-0671.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Office", "tags": [ "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2007-0671" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-08-12", "closedAt": "2025-08-12", "updatedAt": "2025-08-12", "summary": "Microsoft Office Excel contains a remote code execution vulnerability that can be exploited when a specially crafted Excel file is opened. This malicious file could be delivered as an email attachment or hosted on a malicious website. An attacker could leverage this vulnerability by creating a specially crafted Excel file, which, when opened, allowing an attacker to execute remote code on the affected system. Added to CISA KEV on 2025-08-12.", "xPost": null }, { "slug": "toolshell-sharepoint-cve-2025-53770", "title": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770", "json": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft SharePoint Server (on-premises)", "tags": [ "toolshell", "microsoft", "sharepoint", "zero-day", "rce", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-49704", "CVE-2025-49706", "CVE-2025-53770" ], "affectedVersions": [ "On-premises SharePoint Server (see Microsoft customer guidance for the exact builds)" ], "fixedVersions": [ "See Microsoft customer guidance for CVE-2025-53770" ], "startedAt": "2025-07-18", "closedAt": "2025-07-22", "updatedAt": "2025-07-22", "summary": "Unauthenticated RCE chain against on-premises SharePoint Server, mass-exploited from July 18, 2025. Microsoft observed Linen Typhoon, Violet Typhoon and Storm-2603 exploiting it; Storm-2603 deployed Warlock ransomware. Patching alone is not enough: rotate ASP.NET machine keys and restart IIS. SharePoint Online was not affected.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-33053", "title": "Microsoft Windows: Microsoft Windows External Control of File Name or Path Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-33053", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-33053.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-33053" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-06-10", "closedAt": "2025-06-10", "updatedAt": "2025-06-10", "summary": "Microsoft Windows contains an external control of file name or path vulnerability that could allow an attacker to execute code from a remote WebDAV location specified by the WorkingDirectory attribute of Internet Shortcut files. Added to CISA KEV on 2025-06-10.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-30397", "title": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-30397.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-30397", "CVE-2025-30400", "CVE-2025-32701", "CVE-2025-32706", "CVE-2025-32709" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-05-13", "closedAt": "2025-05-13", "updatedAt": "2025-05-13", "summary": "CVE-2025-30397: Microsoft Windows Scripting Engine contains a type confusion vulnerability that allows an unauthorized attacker to execute code over a network via a specially crafted URL. CVE-2025-30400: Microsoft Windows DWM Core Library contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2025-32701: Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2025-32706: Microsoft Windows Common Log File System (CLFS) Driver contains a heap-based buffer overflow vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2025-32709: Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to escalate privileges to administrator. Added to CISA KEV on 2025-05-13.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-24054", "title": "Microsoft Windows: Windows NTLM Hash Disclosure Spoofing Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24054", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-24054.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-24054" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-17", "closedAt": "2025-04-17", "updatedAt": "2025-04-17", "summary": "Microsoft Windows NTLM contains an external control of file name or path vulnerability that allows an unauthorized attacker to perform spoofing over a network. Added to CISA KEV on 2025-04-17.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-29824", "title": "Microsoft Windows: Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-29824", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-29824.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-29824" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-04-08", "closedAt": "2025-04-08", "updatedAt": "2025-04-08", "summary": "Microsoft Windows Common Log File System (CLFS) Driver contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. Added to CISA KEV on 2025-04-08.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-24983", "title": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-24983.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2025-24983", "CVE-2025-24984", "CVE-2025-24985", "CVE-2025-24991", "CVE-2025-24993", "CVE-2025-26633" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-11", "closedAt": "2025-03-11", "updatedAt": "2025-03-11", "summary": "CVE-2025-24983: Microsoft Windows Win32 Kernel Subsystem contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally. CVE-2025-24984: Microsoft Windows New Technology File System (NTFS) contains an insertion of sensitive Information into log file vulnerability that allows an unauthorized attacker to disclose information with a physical attack. An attacker who successfully exploited this vulnerability could potentially read portions of heap memory. CVE-2025-24985: Microsoft Windows Fast FAT File System Driver contains an integer overflow or wraparound vulnerability that allows an unauthorized attacker to execute code locally. CVE-2025-24991: Microsoft Windows New Technology File System (NTFS) contains an out-of-bounds read vulnerability that allows an authorized attacker to disclose information locally. CVE-2025-24993: Microsoft Windows New Technology File System (NTFS) contains a heap-based buffer overflow vulnerability that allows an unauthorized attacker to execute code locally. CVE-2025-26633: Microsoft Windows Management Console (MMC) contains an improper neutralization vulnerability that allows an unauthorized attacker to bypass a security feature locally. Added to CISA KEV on 2025-03-11.", "xPost": null }, { "slug": "microsoft-windows-cve-2018-8639", "title": "Microsoft Windows: Windows Win32k Improper Resource Shutdown or Release Vulnerability", "url": "https://pwn.watch/i/microsoft-windows-cve-2018-8639", "json": "https://pwn.watch/i/microsoft-windows-cve-2018-8639.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2018-8639" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-03-03", "closedAt": "2025-03-03", "updatedAt": "2025-03-03", "summary": "Microsoft Windows Win32k contains an improper resource shutdown or release vulnerability that allows for local, authenticated privilege escalation. An attacker who successfully exploited this vulnerability could run arbitrary code in kernel mode. Added to CISA KEV on 2025-03-03.", "xPost": null }, { "slug": "microsoft-partner-center-cve-2024-49035", "title": "Microsoft Partner Center: Partner Center Improper Access Control Vulnerability", "url": "https://pwn.watch/i/microsoft-partner-center-cve-2024-49035", "json": "https://pwn.watch/i/microsoft-partner-center-cve-2024-49035.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Partner Center", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2024-49035" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-25", "closedAt": "2025-02-25", "updatedAt": "2025-02-25", "summary": "Microsoft Partner Center contains an improper access control vulnerability that allows an attacker to escalate privileges. Added to CISA KEV on 2025-02-25.", "xPost": null }, { "slug": "microsoft-power-pages-cve-2025-24989", "title": "Microsoft Power Pages: Power Pages Improper Access Control Vulnerability", "url": "https://pwn.watch/i/microsoft-power-pages-cve-2025-24989", "json": "https://pwn.watch/i/microsoft-power-pages-cve-2025-24989.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Power Pages", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2025-24989" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-21", "closedAt": "2025-02-21", "updatedAt": "2025-02-21", "summary": "Microsoft Power Pages contains an improper access control vulnerability that allows an unauthorized attacker to elevate privileges over a network potentially bypassing the user registration control. Added to CISA KEV on 2025-02-21.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-21391", "title": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-21391, CVE-2025-21418)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21391", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-21391.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-21391", "CVE-2025-21418" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-11", "closedAt": "2025-02-11", "updatedAt": "2025-02-11", "summary": "CVE-2025-21391: Microsoft Windows Storage contains a link following vulnerability that could allow for privilege escalation. This vulnerability could allow an attacker to delete data including data that results in the service being unavailable. CVE-2025-21418: Microsoft Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Added to CISA KEV on 2025-02-11.", "xPost": null }, { "slug": "microsoft-office-outlook-cve-2024-21413", "title": "Microsoft Office Outlook: Outlook Improper Input Validation Vulnerability", "url": "https://pwn.watch/i/microsoft-office-outlook-cve-2024-21413", "json": "https://pwn.watch/i/microsoft-office-outlook-cve-2024-21413.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Office Outlook", "tags": [ "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-21413" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-06", "closedAt": "2025-02-06", "updatedAt": "2025-02-06", "summary": "Microsoft Outlook contains an improper input validation vulnerability that allows for remote code execution. Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode. Added to CISA KEV on 2025-02-06.", "xPost": null }, { "slug": "microsoft-net-framework-cve-2024-29059", "title": "Microsoft .NET Framework: .NET Framework Information Disclosure Vulnerability", "url": "https://pwn.watch/i/microsoft-net-framework-cve-2024-29059", "json": "https://pwn.watch/i/microsoft-net-framework-cve-2024-29059.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft .NET Framework", "tags": [ "dotnet", "microsoft", "cisa-kev", "rce" ], "cveIds": [ "CVE-2024-29059" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-02-04", "closedAt": "2025-02-04", "updatedAt": "2025-02-04", "summary": "Microsoft .NET Framework contains an information disclosure vulnerability that exposes the ObjRef URI to an attacker, ultimately enabling remote code execution. Added to CISA KEV on 2025-02-04.", "xPost": null }, { "slug": "microsoft-windows-cve-2025-21333", "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)", "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21333", "json": "https://pwn.watch/i/microsoft-windows-cve-2025-21333.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2025-21333", "CVE-2025-21334", "CVE-2025-21335" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2025-01-14", "closedAt": "2025-01-14", "updatedAt": "2025-01-14", "summary": "CVE-2025-21333: Microsoft Windows Hyper-V NT Kernel Integration VSP contains a heap-based buffer overflow vulnerability that allows a local attacker to gain SYSTEM privileges. CVE-2025-21334: Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges. CVE-2025-21335: Microsoft Windows Hyper-V NT Kernel Integration VSP contains a use-after-free vulnerability that allows a local attacker to gain SYSTEM privileges. Added to CISA KEV on 2025-01-14.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-49138", "title": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-49138", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-49138.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2024-49138" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-12-10", "closedAt": "2024-12-10", "updatedAt": "2024-12-10", "summary": "Microsoft Windows Common Log File System (CLFS) driver contains a heap-based buffer overflow vulnerability that allows a local attacker to escalate privileges. Added to the CISA KEV catalog on 2024-12-10.", "xPost": null }, { "slug": "microsoft-zero-days-november-2024-43451-49039", "title": "Microsoft November 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039", "json": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-43451", "CVE-2024-49039" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-11-12", "closedAt": "2024-11-12", "updatedAt": "2024-11-12", "summary": "CVE-2024-43451: Microsoft Windows contains an NTLMv2 hash spoofing vulnerability that could result in disclosing a user's NTLMv2 hash to an attacker via a file open operation. The attacker could then leverage this hash to impersonate that user. CVE-2024-49039: Microsoft Windows Task Scheduler contains a privilege escalation vulnerability that can allow an attacker-provided, local application to escalate privileges outside of its AppContainer, and access privileged RPC functions. Added to the CISA KEV catalog on 2024-11-12. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-zero-days-october-2024-43572-43573", "title": "Microsoft October 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573", "json": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day", "rce" ], "cveIds": [ "CVE-2024-43572", "CVE-2024-43573" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-10-08", "closedAt": "2024-10-08", "updatedAt": "2024-10-08", "summary": "CVE-2024-43572: Microsoft Windows Management Console contains unspecified vulnerability that allows for remote code execution. CVE-2024-43573: Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality. Added to the CISA KEV catalog on 2024-10-08.", "xPost": null }, { "slug": "microsoft-sql-server-cve-2020-0618", "title": "Microsoft SQL Server Reporting Services Remote Code Execution", "url": "https://pwn.watch/i/microsoft-sql-server-cve-2020-0618", "json": "https://pwn.watch/i/microsoft-sql-server-cve-2020-0618.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft SQL Server", "tags": [ "microsoft", "sql-server", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2020-0618" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-18", "closedAt": "2024-09-18", "updatedAt": "2024-09-18", "summary": "Microsoft SQL Server Reporting Services contains a deserialization vulnerability when handling page requests incorrectly. An authenticated attacker can exploit this vulnerability to execute code in the context of the Report Server service account. Added to the CISA KEV catalog on 2024-09-18. CISA lists known use in ransomware campaigns. CVE-2020-0618 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-43461", "title": "Microsoft Windows MSHTML Platform Spoofing", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-43461", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-43461.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2024-43461" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-10", "closedAt": "2024-09-16", "updatedAt": "2024-09-16", "summary": "Microsoft Windows MSHTML Platform contains a user interface (UI) misrepresentation of critical information vulnerability that allows an attacker to spoof a web page. This vulnerability was exploited in conjunction with CVE-2024-38112. Added to the CISA KEV catalog on 2024-09-16.", "xPost": null }, { "slug": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "title": "Microsoft September 2024: 3 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more", "json": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Publisher, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day" ], "cveIds": [ "CVE-2024-38014", "CVE-2024-38217", "CVE-2024-38226" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-09-10", "closedAt": "2024-09-10", "updatedAt": "2024-09-10", "summary": "CVE-2024-38014: Microsoft Windows Installer contains an improper privilege management vulnerability that could allow an attacker to gain SYSTEM privileges. CVE-2024-38217: Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging. CVE-2024-38226: Microsoft Publisher contains a protection mechanism failure vulnerability that allows attacker to bypass Office macro policies used to block untrusted or malicious files. Added to the CISA KEV catalog on 2024-09-10.", "xPost": null }, { "slug": "microsoft-exchange-server-cve-2021-31196", "title": "Microsoft Exchange Server Information Disclosure", "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2021-31196", "json": "https://pwn.watch/i/microsoft-exchange-server-cve-2021-31196.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Exchange Server", "tags": [ "microsoft", "exchange", "cisa-kev", "rce" ], "cveIds": [ "CVE-2021-31196" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-21", "closedAt": "2024-08-21", "updatedAt": "2024-08-21", "summary": "Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-08-21. CVE-2021-31196 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "title": "Microsoft August 2024: 6 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more", "json": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Project, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day", "rce" ], "cveIds": [ "CVE-2024-38106", "CVE-2024-38107", "CVE-2024-38178", "CVE-2024-38189", "CVE-2024-38193", "CVE-2024-38213" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-13", "closedAt": "2024-08-13", "updatedAt": "2024-08-13", "summary": "CVE-2024-38106: Microsoft Windows Kernel contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to win a race condition. CVE-2024-38107: Microsoft Windows Power Dependency Coordinator contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to obtain SYSTEM privileges. CVE-2024-38178: Microsoft Windows Scripting Engine contains a memory corruption vulnerability that allows unauthenticated attacker to initiate remote code execution via a specially crafted URL. CVE-2024-38189: Microsoft Project contains an unspecified vulnerability that allows for remote code execution via a malicious file. CVE-2024-38193: Microsoft Windows Ancillary Function Driver for WinSock contains an unspecified vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. CVE-2024-38213: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience via a malicious file. Added to the CISA KEV catalog on 2024-08-13.", "xPost": null }, { "slug": "microsoft-windows-cve-2018-0824", "title": "Microsoft COM for Windows Deserialization of Untrusted Data", "url": "https://pwn.watch/i/microsoft-windows-cve-2018-0824", "json": "https://pwn.watch/i/microsoft-windows-cve-2018-0824.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "rce" ], "cveIds": [ "CVE-2018-0824" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-08-05", "closedAt": "2024-08-05", "updatedAt": "2024-08-05", "summary": "Microsoft COM for Windows contains a deserialization of untrusted data vulnerability that allows for privilege escalation and remote code execution via a specially crafted file or script. Added to the CISA KEV catalog on 2024-08-05. CVE-2018-0824 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-internet-explorer-cve-2012-4792", "title": "Microsoft Internet Explorer Use-After-Free", "url": "https://pwn.watch/i/microsoft-internet-explorer-cve-2012-4792", "json": "https://pwn.watch/i/microsoft-internet-explorer-cve-2012-4792.json", "status": "closed", "severity": "high", "patchStatus": "unpatched", "product": "Microsoft Internet Explorer", "tags": [ "microsoft", "internet-explorer", "cisa-kev" ], "cveIds": [ "CVE-2012-4792" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "No fix: CISA says the product is end-of-life and should be retired" ], "startedAt": "2024-07-23", "closedAt": "2024-07-23", "updatedAt": "2024-07-23", "summary": "Microsoft Internet Explorer contains a use-after-free vulnerability that allows a remote attacker to execute arbitrary code via a crafted web site that triggers access to an object that (1) was not properly allocated or (2) is deleted, as demonstrated by a CDwnBindInfo object. Added to the CISA KEV catalog on 2024-07-23. CVE-2012-4792 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "crowdstrike-falcon-channel-file-291-outage", "title": "CrowdStrike Falcon update crashes 8.5 million Windows machines", "url": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage", "json": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "CrowdStrike Falcon sensor for Windows", "tags": [ "crowdstrike", "windows", "outage", "edr", "microsoft" ], "cveIds": [], "affectedVersions": [ "Falcon sensor for Windows 7.11 and above, online 04:09-05:27 UTC on 2024-07-19 (CrowdStrike)" ], "fixedVersions": [ "Channel File 291 content reverted at 05:27 UTC; affected hosts needed manual remediation (CrowdStrike)" ], "startedAt": "2024-07-19", "closedAt": "2024-08-06", "updatedAt": "2024-08-06", "summary": "A faulty CrowdStrike Falcon sensor configuration update (Channel File 291) caused a logic error that blue-screened Windows hosts running sensor 7.11 and later that were online between 04:09 and 05:27 UTC on 2024-07-19. Microsoft estimated 8.5 million Windows devices were affected CrowdStrike stressed it was not a cyberattack; it is tracked here because a security agent with kernel-level access took down machines worldwide.", "xPost": null }, { "slug": "microsoft-sharepoint-cve-2024-38094", "title": "Microsoft SharePoint Deserialization", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094", "json": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint", "tags": [ "microsoft", "sharepoint", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2024-38094" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-09", "closedAt": "2024-10-22", "updatedAt": "2024-10-22", "summary": "Microsoft SharePoint contains a deserialization vulnerability that allows for remote code execution. Added to the CISA KEV catalog on 2024-10-22. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-zero-days-july-2024-38080-38112", "title": "Microsoft July 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112", "json": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "zero-day" ], "cveIds": [ "CVE-2024-38080", "CVE-2024-38112" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-07-09", "closedAt": "2024-07-09", "updatedAt": "2024-07-09", "summary": "CVE-2024-38080: Microsoft Windows Hyper-V contains a privilege escalation vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. CVE-2024-38112: Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability. Added to the CISA KEV catalog on 2024-07-09.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-30088", "title": "Microsoft Windows Kernel TOCTOU Race Condition", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-30088", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-30088.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-30088" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-11", "closedAt": "2024-10-15", "updatedAt": "2024-10-15", "summary": "Microsoft Windows Kernel contains a time-of-check to time-of-use (TOCTOU) race condition vulnerability that could allow for privilege escalation. Added to the CISA KEV catalog on 2024-10-15. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-35250", "title": "Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-35250", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-35250.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2024-35250" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-06-11", "closedAt": "2024-12-16", "updatedAt": "2024-12-16", "summary": "Microsoft Windows Kernel-Mode Driver contains an untrusted pointer dereference vulnerability that allows a local attacker to escalate privileges. Added to the CISA KEV catalog on 2024-12-16.", "xPost": null }, { "slug": "microsoft-zero-days-may-2024-30040-30051", "title": "Microsoft May 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051", "json": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft DWM Core Library, Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-30040", "CVE-2024-30051" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-05-14", "closedAt": "2024-05-14", "updatedAt": "2024-05-14", "summary": "CVE-2024-30040: Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for a security feature bypass. CVE-2024-30051: Microsoft DWM Core Library contains a privilege escalation vulnerability that allows an attacker to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-05-14. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2022-38028", "title": "Microsoft Windows Print Spooler Privilege Escalation", "url": "https://pwn.watch/i/microsoft-windows-cve-2022-38028", "json": "https://pwn.watch/i/microsoft-windows-cve-2022-38028.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2022-38028" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-04-23", "closedAt": "2024-04-23", "updatedAt": "2024-04-23", "summary": "Microsoft Windows Print Spooler service contains a privilege escalation vulnerability. An attacker may modify a JavaScript constraints file and execute it with SYSTEM-level permissions. Added to the CISA KEV catalog on 2024-04-23. CVE-2022-38028 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-smartscreen-prompt-cve-2024-29988", "title": "Microsoft SmartScreen Prompt Security Feature Bypass", "url": "https://pwn.watch/i/microsoft-smartscreen-prompt-cve-2024-29988", "json": "https://pwn.watch/i/microsoft-smartscreen-prompt-cve-2024-29988.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SmartScreen Prompt", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2024-29988" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-04-09", "closedAt": "2024-04-30", "updatedAt": "2024-04-30", "summary": "Microsoft SmartScreen Prompt contains a security feature bypass vulnerability that allows an attacker to bypass the Mark of the Web (MotW) feature. This vulnerability can be chained with CVE-2023-38831 and CVE-2024-21412 to execute a malicious file. Added to the CISA KEV catalog on 2024-04-30.", "xPost": null }, { "slug": "microsoft-sharepoint-server-cve-2023-24955", "title": "Microsoft SharePoint Server Code Injection", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955", "json": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft SharePoint Server", "tags": [ "microsoft", "sharepoint", "cisa-kev", "ransomware", "rce" ], "cveIds": [ "CVE-2023-24955" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-26", "closedAt": "2024-03-26", "updatedAt": "2024-03-26", "summary": "Microsoft SharePoint Server contains a code injection vulnerability that allows an authenticated attacker with Site Owner privileges to execute code remotely. Added to the CISA KEV catalog on 2024-03-26. CISA lists known use in ransomware campaigns. CVE-2023-24955 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-26169", "title": "Microsoft Windows Error Reporting Service Improper Privilege Management", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-26169", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-26169.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-26169" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-03-12", "closedAt": "2024-06-13", "updatedAt": "2024-06-13", "summary": "Microsoft Windows Error Reporting Service contains an improper privilege management vulnerability that allows a local attacker with user permissions to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-06-13. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-streaming-service-cve-2023-29360", "title": "Microsoft Streaming Service Untrusted Pointer Dereference", "url": "https://pwn.watch/i/microsoft-streaming-service-cve-2023-29360", "json": "https://pwn.watch/i/microsoft-streaming-service-cve-2023-29360.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Streaming Service", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2023-29360" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-29", "closedAt": "2024-02-29", "updatedAt": "2024-02-29", "summary": "Microsoft Streaming Service contains an untrusted pointer dereference vulnerability that allows for privilege escalation, enabling a local attacker to gain SYSTEM privileges. Added to the CISA KEV catalog on 2024-02-29. CVE-2023-29360 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-exchange-server-cve-2024-21410", "title": "Microsoft Exchange Server Privilege Escalation", "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2024-21410", "json": "https://pwn.watch/i/microsoft-exchange-server-cve-2024-21410.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Exchange Server", "tags": [ "microsoft", "exchange", "cisa-kev" ], "cveIds": [ "CVE-2024-21410" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-13", "closedAt": "2024-02-15", "updatedAt": "2024-02-15", "summary": "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. Added to the CISA KEV catalog on 2024-02-15.", "xPost": null }, { "slug": "microsoft-windows-cve-2024-21338", "title": "Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-21338", "json": "https://pwn.watch/i/microsoft-windows-cve-2024-21338.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2024-21338" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-13", "closedAt": "2024-03-04", "updatedAt": "2024-03-04", "summary": "Microsoft Windows Kernel contains an exposed IOCTL with insufficient access control vulnerability within the IOCTL (input and output control) dispatcher in appid.sys that allows a local attacker to achieve privilege escalation. Added to the CISA KEV catalog on 2024-03-04. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-zero-days-february-2024-21351-21412", "title": "Microsoft February 2024: 2 actively exploited zero-days", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412", "json": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "ransomware", "zero-day" ], "cveIds": [ "CVE-2024-21351", "CVE-2024-21412" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-02-13", "closedAt": "2024-02-13", "updatedAt": "2024-02-13", "summary": "CVE-2024-21351: Microsoft Windows SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the SmartScreen user experience and inject code to potentially gain code execution, which could lead to some data exposure, lack of system availability, or both. CVE-2024-21412: Microsoft Windows Internet Shortcut Files contains an unspecified vulnerability that allows for a security feature bypass. Added to the CISA KEV catalog on 2024-02-13. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-midnight-blizzard-corporate-email-breach", "title": "Midnight Blizzard breaches Microsoft corporate email", "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach", "json": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json", "status": "closed", "severity": "high", "patchStatus": "no-fix-needed", "product": "Microsoft corporate email (Microsoft 365)", "tags": [ "microsoft", "microsoft-365", "midnight-blizzard", "espionage", "password-spraying", "data-breach", "nation-state" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2024-01-12", "closedAt": "2024-04-02", "updatedAt": "2024-04-02", "summary": "Russia's Midnight Blizzard (APT29) password-sprayed a legacy, non-production Microsoft test tenant without MFA, then abused an OAuth app to read email of Microsoft senior leadership and security staff. Microsoft detected the attack on 2024-01-12. Stolen emails included correspondence with US federal agencies, so CISA issued Emergency Directive 24-02 ordering agencies to analyze the exposed emails and reset any compromised credentials.", "xPost": null }, { "slug": "microsoft-sharepoint-server-cve-2023-29357", "title": "Microsoft SharePoint Server Privilege Escalation", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357", "json": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft SharePoint Server", "tags": [ "microsoft", "sharepoint", "cisa-kev", "ransomware" ], "cveIds": [ "CVE-2023-29357" ], "affectedVersions": [ "See vendor advisory (versions are not listed in the KEV record)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2024-01-10", "closedAt": "2024-01-10", "updatedAt": "2024-01-10", "summary": "Microsoft SharePoint Server contains an unspecified vulnerability that allows an unauthenticated attacker, who has gained access to spoofed JWT authentication tokens, to use them for executing a network attack. This attack bypasses authentication, enabling the attacker to gain administrator privileges. Added to the CISA KEV catalog on 2024-01-10. CISA lists known use in ransomware campaigns. CVE-2023-29357 was assigned before 2024; the KEV listing came in 2024.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-36584", "title": "Microsoft Windows: Mark of the Web (MOTW) Security Feature Bypass (CVE-2023-36584)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36584", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-36584.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev" ], "cveIds": [ "CVE-2023-36584" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-11-16", "closedAt": "2023-11-16", "updatedAt": "2023-11-16", "summary": "Microsoft Windows Mark of the Web (MOTW) contains a security feature bypass vulnerability resulting in a limited loss of integrity and availability of security features. Added to CISA KEV on 2023-11-16.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-36025-36033-36036", "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-36025", "CVE-2023-36033", "CVE-2023-36036" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-11-14", "closedAt": "2023-11-14", "updatedAt": "2023-11-14", "summary": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to bypass Windows Defender SmartScreen checks and their associated prompts. Microsoft Windows Desktop Window Manager (DWM) Core Library contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Cloud Files Mini Filter Driver contains a privilege escalation vulnerability that could allow an attacker to gain SYSTEM privileges. Added to CISA KEV on 2023-11-14.", "xPost": null }, { "slug": "microsoft-skype-for-business-cve-2023-41763", "title": "Microsoft Skype for Business: Privilege Escalation (CVE-2023-41763)", "url": "https://pwn.watch/i/microsoft-skype-for-business-cve-2023-41763", "json": "https://pwn.watch/i/microsoft-skype-for-business-cve-2023-41763.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Microsoft Skype for Business", "tags": [ "microsoft", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-41763" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-10-10", "closedAt": "2023-10-10", "updatedAt": "2023-10-10", "summary": "Microsoft Skype for Business contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-10-10.", "xPost": null }, { "slug": "microsoft-wordpad-cve-2023-36563", "title": "Microsoft WordPad: Information Disclosure (CVE-2023-36563)", "url": "https://pwn.watch/i/microsoft-wordpad-cve-2023-36563", "json": "https://pwn.watch/i/microsoft-wordpad-cve-2023-36563.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Microsoft WordPad", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2023-36563" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-10-10", "closedAt": "2023-10-10", "updatedAt": "2023-10-10", "summary": "Microsoft WordPad contains an unspecified vulnerability that allows for information disclosure. Added to CISA KEV on 2023-10-10.", "xPost": null }, { "slug": "microsoft-windows-cng-key-isolation-service-cve-2023-28229", "title": "Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)", "url": "https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229", "json": "https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows CNG Key Isolation Service", "tags": [ "microsoft", "windows", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-28229" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-10-04", "closedAt": "2023-10-04", "updatedAt": "2023-10-04", "summary": "Microsoft Windows Cryptographic Next Generation (CNG) Key Isolation Service contains an unspecified vulnerability that allows an attacker to gain specific limited SYSTEM privileges. Added to CISA KEV on 2023-10-04.", "xPost": null }, { "slug": "microsoft-streaming-service-proxy-cve-2023-36802", "title": "Microsoft Streaming Service Proxy: Privilege Escalation (CVE-2023-36802)", "url": "https://pwn.watch/i/microsoft-streaming-service-proxy-cve-2023-36802", "json": "https://pwn.watch/i/microsoft-streaming-service-proxy-cve-2023-36802.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Streaming Service Proxy", "tags": [ "microsoft", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-36802" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-09-12", "closedAt": "2023-09-12", "updatedAt": "2023-09-12", "summary": "Microsoft Streaming Service Proxy contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-09-12.", "xPost": null }, { "slug": "microsoft-word-cve-2023-36761", "title": "Microsoft Word: Information Disclosure (CVE-2023-36761)", "url": "https://pwn.watch/i/microsoft-word-cve-2023-36761", "json": "https://pwn.watch/i/microsoft-word-cve-2023-36761.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Microsoft Word", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2023-36761" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-09-12", "closedAt": "2023-09-12", "updatedAt": "2023-09-12", "summary": "Microsoft Word contains an unspecified vulnerability that allows for information disclosure. Added to CISA KEV on 2023-09-12.", "xPost": null }, { "slug": "microsoft-net-core-and-visual-studio-cve-2023-38180", "title": "Microsoft .NET Core and Visual Studio: Denial-of-Service (CVE-2023-38180)", "url": "https://pwn.watch/i/microsoft-net-core-and-visual-studio-cve-2023-38180", "json": "https://pwn.watch/i/microsoft-net-core-and-visual-studio-cve-2023-38180.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft .NET Core and Visual Studio", "tags": [ "dotnet", "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2023-38180" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-08-09", "closedAt": "2023-08-09", "updatedAt": "2023-08-09", "summary": "Microsoft .NET Core and Visual Studio contain an unspecified vulnerability that allows for denial-of-service (DoS). Added to CISA KEV on 2023-08-09.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-36884", "title": "Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36884", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-36884.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "rce" ], "cveIds": [ "CVE-2023-36884" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-07-17", "closedAt": "2023-07-17", "updatedAt": "2023-07-17", "summary": "Microsoft Windows Search contains an unspecified vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file, leading to remote code execution. Added to CISA KEV on 2023-07-17. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-outlook-cve-2023-35311", "title": "Microsoft Outlook: Security Feature Bypass (CVE-2023-35311)", "url": "https://pwn.watch/i/microsoft-outlook-cve-2023-35311", "json": "https://pwn.watch/i/microsoft-outlook-cve-2023-35311.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Outlook", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2023-35311" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-07-11", "closedAt": "2023-07-11", "updatedAt": "2023-07-11", "summary": "Microsoft Outlook contains a security feature bypass vulnerability that allows an attacker to bypass the Microsoft Outlook Security Notice prompt. Added to CISA KEV on 2023-07-11.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-32046-32049-36874", "title": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-32046", "CVE-2023-32049", "CVE-2023-36874" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-07-11", "closedAt": "2023-07-11", "updatedAt": "2023-07-11", "summary": "Microsoft Windows MSHTML Platform contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Defender SmartScreen contains a security feature bypass vulnerability that allows an attacker to bypass the Open File - Security Warning prompt. Microsoft Windows Error Reporting Service contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-07-11.", "xPost": null }, { "slug": "microsoft-ai-research-sas-token-38tb-exposure-2023", "title": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023", "json": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Azure Storage (SAS token in a GitHub repo)", "tags": [ "ai", "microsoft", "azure", "github", "secrets", "misconfiguration", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-06-22", "closedAt": "2023-09-18", "updatedAt": "2023-09-18", "summary": "A public GitHub repo of Microsoft AI training models shared an Azure Storage SAS token with full-control permissions on a whole storage account. It exposed 38TB of internal data, including workstation backups, secrets and Teams messages. Wiz found and reported it.", "xPost": null }, { "slug": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "title": "Storm-0558: stolen Microsoft signing key used to read government email", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023", "json": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Exchange Online / Outlook.com (Azure AD and MSA token signing)", "tags": [ "microsoft", "microsoft-365", "exchange-online", "azure", "china", "token-forgery", "data-breach" ], "cveIds": [], "affectedVersions": [], "fixedVersions": [], "startedAt": "2023-05-15", "closedAt": "2023-09-06", "updatedAt": "2023-09-06", "summary": "China-based Storm-0558 used a stolen Microsoft consumer (MSA) signing key, plus a token validation bug, to forge tokens and read Exchange Online and Outlook.com mail at about 25 organisations, including US government agencies. Microsoft later said the key leaked through a 2021 crash dump.", "xPost": null }, { "slug": "microsoft-win32k-cve-2023-29336", "title": "Microsoft Win32k: Privilege Escalation (CVE-2023-29336)", "url": "https://pwn.watch/i/microsoft-win32k-cve-2023-29336", "json": "https://pwn.watch/i/microsoft-win32k-cve-2023-29336.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Win32k", "tags": [ "microsoft", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-29336" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-05-09", "closedAt": "2023-05-09", "updatedAt": "2023-05-09", "summary": "Microsoft Win32k contains an unspecified vulnerability that allows for privilege escalation up to SYSTEM privileges. Added to CISA KEV on 2023-05-09.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-28252", "title": "Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-28252", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-28252.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-28252" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-04-11", "closedAt": "2023-04-11", "updatedAt": "2023-04-11", "summary": "Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-04-11. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-outlook-ntlm-leak-cve-2023-23397", "title": "Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)", "url": "https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397", "json": "https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397.json", "status": "closed", "severity": "critical", "patchStatus": "patched", "product": "Microsoft Outlook for Windows", "tags": [ "microsoft", "outlook", "ntlm", "apt28", "zero-click", "zero-day", "cisa-kev" ], "cveIds": [ "CVE-2023-23397" ], "affectedVersions": [ "See vendor advisory" ], "fixedVersions": [ "See vendor advisory (March 2023 security updates)" ], "startedAt": "2023-03-14", "closedAt": "2023-03-24", "updatedAt": "2023-03-24", "summary": "A crafted Outlook reminder with a UNC path made Outlook for Windows send the user's NTLM hash to an attacker's server without any click. Microsoft said a Russia-based actor (APT28) used it against European government, transport, energy and military targets.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-24880", "title": "Microsoft Windows: SmartScreen Security Feature Bypass (CVE-2023-24880)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-24880", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-24880.json", "status": "closed", "severity": "medium", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev" ], "cveIds": [ "CVE-2023-24880" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-03-14", "closedAt": "2023-03-14", "updatedAt": "2023-03-14", "summary": "Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file. Added to CISA KEV on 2023-03-14. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-office-cve-2023-21715", "title": "Microsoft Office: Publisher Security Feature Bypass (CVE-2023-21715)", "url": "https://pwn.watch/i/microsoft-office-cve-2023-21715", "json": "https://pwn.watch/i/microsoft-office-cve-2023-21715.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Office", "tags": [ "microsoft", "cisa-kev" ], "cveIds": [ "CVE-2023-21715" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-14", "closedAt": "2023-02-14", "updatedAt": "2023-02-14", "summary": "Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system. Added to CISA KEV on 2023-02-14.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-21823-23376", "title": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "ransomware", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-21823", "CVE-2023-23376" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-02-14", "closedAt": "2023-02-14", "updatedAt": "2023-02-14", "summary": "Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation. Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-02-14. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-exchange-server-cve-2022-41080", "title": "Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)", "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080", "json": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Exchange Server", "tags": [ "microsoft", "ransomware", "cisa-kev", "rce", "privilege-escalation" ], "cveIds": [ "CVE-2022-41080" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-01-10", "closedAt": "2023-01-10", "updatedAt": "2023-01-10", "summary": "Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution. Added to CISA KEV on 2023-01-10. CISA lists known use in ransomware campaigns.", "xPost": null }, { "slug": "microsoft-windows-cve-2023-21674", "title": "Microsoft Windows: Advanced Local Procedure Call (ALPC) Privilege Escalation (CVE-2023-21674)", "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21674", "json": "https://pwn.watch/i/microsoft-windows-cve-2023-21674.json", "status": "closed", "severity": "high", "patchStatus": "patched", "product": "Microsoft Windows", "tags": [ "microsoft", "windows", "cisa-kev", "privilege-escalation" ], "cveIds": [ "CVE-2023-21674" ], "affectedVersions": [ "See vendor advisory / CISA notes (versions not always listed in KEV feed)" ], "fixedVersions": [ "See vendor advisory linked in sources" ], "startedAt": "2023-01-10", "closedAt": "2023-01-10", "updatedAt": "2023-01-10", "summary": "Microsoft Windows Advanced Local Procedure Call (ALPC) contains an unspecified vulnerability that allows for privilege escalation. Added to CISA KEV on 2023-01-10.", "xPost": null } ], "posts": [ { "authorName": "SC Media", "handle": "SCMagazine", "avatarUrl": "https://pbs.twimg.com/profile_images/1382075890935468032/wEHUGLMA_bigger.jpg", "text": "A stolen @ConnectWise app credential exposed Microsoft 365 tenants to unauthorized access and privilege escalation. The breach highlights the risks of overprivileged app identities. #cybersecurity #CISO #infosec https://t.co/Xyi8IHRc6u", "date": "2026-10-22T13:28:01.000Z", "url": "https://x.com/SCMagazine/status/2113261090419233058", "media": [], "incident": "connectwise-cloud-backup-m365-hijack" }, { "authorName": "The Register", "handle": "TheRegister", "avatarUrl": "https://pbs.twimg.com/profile_images/1790422162228277252/Kn-bAizu_bigger.jpg", "text": "China-aligned attackers used AI agents and compromised ConnectWise application creds to target more than 2,250 Microsoft 365 tenants, the vendor says. \nMore here: https://t.co/CrHYzab3cD", "date": "2026-10-22T12:34:34.000Z", "url": "https://x.com/TheRegister/status/2113247638976102527", "media": [], "incident": "connectwise-cloud-backup-m365-hijack" }, { "authorName": "bvcyberguardian", "handle": "bvcyberguardian", "avatarUrl": "https://pbs.twimg.com/profile_images/2072419215970082816/V3aI9G5b_bigger.jpg", "text": "🔴 Patch Windows right now.\n\nCVE-2026-96951 — a \"Mark of the Web\" bypass — is being actively exploited in the wild. A malicious ZIP or ISO can run code on your machine without triggering security warnings.\n\nStart → Settings → Windows Update → Check for updates.\n\nDon't postpone", "date": "2026-10-19T13:07:34.000Z", "url": "https://x.com/bvcyberguardian/status/2112168782596833559", "media": [], "incident": "windows-shell-cve-2026-96951-motw" }, { "authorName": "Novacybersecurity Inc. & Associates", "handle": "thenovacyberXBT", "avatarUrl": "https://pbs.twimg.com/profile_images/2109756295289131008/LyqgwmUQ_bigger.jpg", "text": "Patch fast, stay safe. Attackers exploit known flaws within days, like this month's Windows Shell zero-day (CVE-2026-96951) and the Linux \"PwnEscape\" bug (CVE-2026-99999).\nUpdate Windows and Linux today, turn on auto-updates, and use MFA.\n#CyberSecurity #PatchManagement #InfoSec https://t.co/WYVnDmsENU", "date": "2026-10-18T11:30:36.000Z", "url": "https://x.com/thenovacyberXBT/status/2111781993109495979", "media": [ { "type": "image", "url": "https://pbs.twimg.com/media/HU6OgPJbAAAo_t6.jpg" } ], "incident": "windows-shell-cve-2026-96951-motw" }, { "authorName": "InfraSecurity Services", "handle": "infrasecserv", "avatarUrl": "https://pbs.twimg.com/profile_images/2033955264173338626/ClYbz4n0_bigger.png", "text": "October Patch Tuesday: 1,408 CVEs, 72 critical. Zero-day CVE-2026-96951 (Windows Shell Mark of the Web bypass) is exploited, CISA deadline Oct 16. SharePoint CVE-2026-65660 is also exploited, yet Microsoft's guide still says No. #PatchTuesday #InfoSec", "date": "2026-10-18T08:03:54.000Z", "url": "https://x.com/infrasecserv/status/2111729974159827024", "media": [], "incident": "windows-shell-cve-2026-96951-motw" } ], "changes": [ { "incident": "connectwise-cloud-backup-m365-hijack", "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Microsoft details Storm-0940's Oct 10-14 password spray (151,000+ failed logons, peak 2,900/min) before the Oct 15 takeover of ConnectWise cloud app identities; ConnectWise says phased service restoration will take several days.", "body": null, "sourceUrl": "https://thehackernews.com/2026/10/china-linked-hackers-use-artex-ai.html", "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack" }, { "incident": "connectwise-cloud-backup-m365-hijack", "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "ConnectWise CEO Manny Rivelo says the affected application connections are contained and services are being restored gradually, but cutting those connections won't necessarily evict attackers who already set up persistent access in customer tenants. Microsoft hasn't said how many customers were compromised.", "body": null, "sourceUrl": "https://www.theregister.com/security/2026/10/22/microsoft-says-connectwise-breach-let-chinese-spies-loose-on-2250-cloud-tenants/5304687", "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack" }, { "incident": "connectwise-cloud-backup-m365-hijack", "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-22", "title": "Wiz Research says the same ARTEX-using actor, overlapping with Storm-0940, is also targeting other IT and software vendors: password-spraying Okta and Entra, abusing Cognito and account-recovery endpoints, and probing Microsoft 365 integrations and tenant isolation. Wiz published IPs and user agents to hunt for.", "body": null, "sourceUrl": "https://www.wiz.io/blog/artex-in-the-wild-storm-0940-expands-targeting-of-it-and-software-vendors", "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack" }, { "incident": "connectwise-cloud-backup-m365-hijack", "incidentTitle": "ConnectWise Cloud Backup shut down after M365 app-identity hijack", "severity": "critical", "status": "live", "patchStatus": "partial", "date": "2026-10-21", "title": "Microsoft attributes the ConnectWise supply-chain compromise to China-aligned Storm-0940, using the agentic AI framework ARTEX; 2,250+ Microsoft 365 tenants targeted.", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2026/10/21/storm-0940-uses-artex-agentic-ai-connectwise-supply-chain-compromise/", "url": "https://pwn.watch/i/connectwise-cloud-backup-m365-hijack" }, { "incident": "windows-shell-cve-2026-96951-motw", "incidentTitle": "Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-10-13", "title": "Microsoft ships patches; CISA KEV lists CVE-2026-96951.", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/windows-shell-cve-2026-96951-motw" }, { "incident": "microsoft-sharepoint-cve-2026-65660", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-25", "title": "CISA added CVE-2026-65660 to the KEV catalog (due 2026-09-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660" }, { "incident": "microsoft-windows-cve-2026-81963", "incidentTitle": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-09-08", "title": "CISA added CVE-2026-81963, CVE-2026-85880 to the KEV catalog (due 2026-09-22).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-81963" }, { "incident": "microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824", "incidentTitle": "Microsoft Internet Key Exchange (IKE) Service Extensions: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-18", "title": "CISA added CVE-2026-33824 to the KEV catalog (due 2026-08-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824" }, { "incident": "microsoft-sharepoint-cve-2026-55040", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Weak Authentication Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-18", "title": "CISA added CVE-2026-55040 to the KEV catalog (due 2026-08-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040" }, { "incident": "microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820", "incidentTitle": "Microsoft Windows Ancillary Function Driver for WinSock : Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-08-11", "title": "CISA added CVE-2026-68820 to the KEV catalog (due 2026-08-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820" }, { "incident": "microsoft-sharepoint-cve-2026-50522", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-22", "title": "CISA added CVE-2026-50522 to the KEV catalog (due 2026-07-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522" }, { "incident": "microsoft-sharepoint-cve-2026-58644", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-16", "title": "CISA added CVE-2026-58644 to the KEV catalog (due 2026-07-19).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644" }, { "incident": "microsoft-active-directory-federation-services-cve-2026-56155", "incidentTitle": "Microsoft Active Directory Federation Services: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-14", "title": "CISA added CVE-2026-56155 to the KEV catalog (due 2026-07-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-active-directory-federation-services-cve-2026-56155" }, { "incident": "microsoft-sharepoint-server-cve-2026-56164", "incidentTitle": "Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-14", "title": "CISA added CVE-2026-56164 to the KEV catalog (due 2026-07-17).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164" }, { "incident": "microsoft-sharepoint-server-cve-2026-45659", "incidentTitle": "Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-07-01", "title": "CISA added CVE-2026-45659 to the KEV catalog (due 2026-07-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659" }, { "incident": "microsoft-defender-cve-2026-41091", "incidentTitle": "Microsoft Defender: Microsoft Defender Link Following Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-20", "title": "CISA added CVE-2026-41091, CVE-2026-45498 to the KEV catalog (due 2026-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-defender-cve-2026-41091" }, { "incident": "microsoft-microsoft-cve-2026-42897", "incidentTitle": "Microsoft Microsoft: Microsoft Exchange Server Cross-Site Scripting Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-05-15", "title": "CISA added CVE-2026-42897 to the KEV catalog (due 2026-05-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-microsoft-cve-2026-42897" }, { "incident": "microsoft-windows-cve-2026-32202", "incidentTitle": "Microsoft Windows: Microsoft Windows Protection Mechanism Failure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-28", "title": "CISA added CVE-2026-32202 to the KEV catalog (due 2026-05-12).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-32202" }, { "incident": "microsoft-defender-cve-2026-33825", "incidentTitle": "Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-22", "title": "CISA added CVE-2026-33825 to the KEV catalog (due 2026-05-06).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-defender-cve-2026-33825" }, { "incident": "microsoft-sharepoint-server-cve-2026-32201", "incidentTitle": "Microsoft SharePoint Server: Microsoft SharePoint Server Improper Input Validation Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-14", "title": "CISA added CVE-2026-32201 to the KEV catalog (due 2026-04-28).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201" }, { "incident": "microsoft-windows-cve-2025-60710", "incidentTitle": "Microsoft Windows: Microsoft Windows Link Following Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-04-13", "title": "CISA added CVE-2025-60710, CVE-2023-36424 to the KEV catalog (due 2026-04-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-60710" }, { "incident": "microsoft-sharepoint-cve-2026-20963", "incidentTitle": "Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-03-18", "title": "CISA added CVE-2026-20963 to the KEV catalog (due 2026-03-21).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963" }, { "incident": "microsoft-office-cve-2026-21514", "incidentTitle": "Microsoft Office: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-10", "title": "CISA added CVE-2026-21514 to the KEV catalog (due 2026-03-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-office-cve-2026-21514" }, { "incident": "microsoft-windows-cve-2026-21513", "incidentTitle": "Microsoft Windows: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-02-10", "title": "CISA added CVE-2026-21513, CVE-2026-21525, CVE-2026-21510, CVE-2026-21533, CVE-2026-21519 to the KEV catalog (due 2026-03-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-21513" }, { "incident": "microsoft-office-cve-2026-21509", "incidentTitle": "Microsoft Office: Microsoft Office Security Feature Bypass Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-26", "title": "CISA added CVE-2026-21509 to the KEV catalog (due 2026-02-16).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-office-cve-2026-21509" }, { "incident": "microsoft-windows-cve-2026-20805", "incidentTitle": "Microsoft Windows: Microsoft Windows Information Disclosure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2026-01-13", "title": "CISA added CVE-2026-20805 to the KEV catalog (due 2026-02-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2026-20805" }, { "incident": "microsoft-windows-cve-2025-62221", "incidentTitle": "Microsoft Windows: Windows Use After Free Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-12-09", "title": "CISA added CVE-2025-62221 to the KEV catalog (due 2025-12-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-62221" }, { "incident": "microsoft-windows-cve-2025-62215", "incidentTitle": "Microsoft Windows: Windows Race Condition Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-11-12", "title": "CISA added CVE-2025-62215 to the KEV catalog (due 2025-12-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-62215" }, { "incident": "microsoft-windows-cve-2025-59287", "incidentTitle": "Microsoft Windows: Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-24", "title": "CISA added CVE-2025-59287 to the KEV catalog (due 2025-11-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-59287" }, { "incident": "microsoft-windows-cve-2025-33073", "incidentTitle": "Microsoft Windows: Windows SMB Client Improper Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-20", "title": "CISA added CVE-2025-33073 to the KEV catalog (due 2025-11-10).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-33073" }, { "incident": "microsoft-windows-cve-2025-24990", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-24990, CVE-2025-59230)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-14", "title": "CISA added CVE-2025-24990 to the KEV catalog (due 2025-11-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24990" }, { "incident": "microsoft-windows-cve-2025-24990", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-24990, CVE-2025-59230)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-14", "title": "CISA added CVE-2025-59230 to the KEV catalog (due 2025-11-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24990" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2011-3402 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2013-3918 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "microsoft-windows-cve-2011-3402", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2021-43226 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2011-3402" }, { "incident": "microsoft-internet-explorer-cve-2010-3962", "incidentTitle": "Microsoft Internet Explorer: Internet Explorer Uninitialized Memory Corruption Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-10-06", "title": "CISA added CVE-2010-3962 to the KEV catalog (due 2025-10-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-internet-explorer-cve-2010-3962" }, { "incident": "microsoft-internet-explorer-cve-2013-3893", "incidentTitle": "Microsoft Internet Explorer: Internet Explorer Resource Management Errors Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-08-12", "title": "CISA added CVE-2013-3893 to the KEV catalog (due 2025-09-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-internet-explorer-cve-2013-3893" }, { "incident": "microsoft-office-cve-2007-0671", "incidentTitle": "Microsoft Office: Office Excel Remote Code Execution Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-08-12", "title": "CISA added CVE-2007-0671 to the KEV catalog (due 2025-09-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-office-cve-2007-0671" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-22", "title": "Microsoft attributes exploitation to Linen Typhoon, Violet Typhoon and Storm-2603", "body": "Storm-2603 deployed Warlock ransomware.", "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2025/07/22/disrupting-active-exploitation-of-on-premises-sharepoint-vulnerabilities/", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-22", "title": "CISA adds CVE-2025-49704 and CVE-2025-49706 to KEV", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-20", "title": "CISA adds CVE-2025-53770 to KEV and publishes guidance", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/alerts/2025/07/20/update-microsoft-releases-guidance-exploitation-sharepoint-vulnerabilities", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-19", "title": "Microsoft publishes customer guidance for CVE-2025-53770", "body": "Apply updates, enable AMSI Full Mode, deploy Defender/EDR, rotate ASP.NET machine keys and restart IIS.", "sourceUrl": "https://www.microsoft.com/en-us/msrc/blog/2025/07/customer-guidance-for-sharepoint-vulnerability-cve-2025-53770", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "toolshell-sharepoint-cve-2025-53770", "incidentTitle": "ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-07-18", "title": "Eye Security observes large-scale exploitation of on-prem SharePoint servers", "body": "Later clarified as the original ToolShell chain (CVE-2025-49706 + CVE-2025-49704).", "sourceUrl": "https://research.eye.security/sharepoint-under-siege/", "url": "https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770" }, { "incident": "microsoft-windows-cve-2025-33053", "incidentTitle": "Microsoft Windows: Microsoft Windows External Control of File Name or Path Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-06-10", "title": "CISA added CVE-2025-33053 to the KEV catalog (due 2025-07-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-33053" }, { "incident": "microsoft-windows-cve-2025-30397", "incidentTitle": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-13", "title": "CISA added CVE-2025-30397 to the KEV catalog (due 2025-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397" }, { "incident": "microsoft-windows-cve-2025-30397", "incidentTitle": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-13", "title": "CISA added CVE-2025-30400 to the KEV catalog (due 2025-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397" }, { "incident": "microsoft-windows-cve-2025-30397", "incidentTitle": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-13", "title": "CISA added CVE-2025-32701 to the KEV catalog (due 2025-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397" }, { "incident": "microsoft-windows-cve-2025-30397", "incidentTitle": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-13", "title": "CISA added CVE-2025-32706 to the KEV catalog (due 2025-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397" }, { "incident": "microsoft-windows-cve-2025-30397", "incidentTitle": "Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-05-13", "title": "CISA added CVE-2025-32709 to the KEV catalog (due 2025-06-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-30397" }, { "incident": "microsoft-windows-cve-2025-24054", "incidentTitle": "Microsoft Windows: Windows NTLM Hash Disclosure Spoofing Vulnerability", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2025-04-17", "title": "CISA added CVE-2025-24054 to the KEV catalog (due 2025-05-08).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24054" }, { "incident": "microsoft-windows-cve-2025-29824", "incidentTitle": "Microsoft Windows: Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-04-08", "title": "CISA added CVE-2025-29824 to the KEV catalog (due 2025-04-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-29824" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24983 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24984 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24985 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24991 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-24993 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2025-24983", "incidentTitle": "Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-11", "title": "CISA added CVE-2025-26633 to the KEV catalog (due 2025-04-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-24983" }, { "incident": "microsoft-windows-cve-2018-8639", "incidentTitle": "Microsoft Windows: Windows Win32k Improper Resource Shutdown or Release Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-03-03", "title": "CISA added CVE-2018-8639 to the KEV catalog (due 2025-03-24).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2018-8639" }, { "incident": "microsoft-partner-center-cve-2024-49035", "incidentTitle": "Microsoft Partner Center: Partner Center Improper Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-25", "title": "CISA added CVE-2024-49035 to the KEV catalog (due 2025-03-18).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-partner-center-cve-2024-49035" }, { "incident": "microsoft-power-pages-cve-2025-24989", "incidentTitle": "Microsoft Power Pages: Power Pages Improper Access Control Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-21", "title": "CISA added CVE-2025-24989 to the KEV catalog (due 2025-03-14).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-power-pages-cve-2025-24989" }, { "incident": "microsoft-windows-cve-2025-21391", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-21391, CVE-2025-21418)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-11", "title": "CISA added CVE-2025-21391 to the KEV catalog (due 2025-03-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21391" }, { "incident": "microsoft-windows-cve-2025-21391", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-21391, CVE-2025-21418)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-11", "title": "CISA added CVE-2025-21418 to the KEV catalog (due 2025-03-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21391" }, { "incident": "microsoft-office-outlook-cve-2024-21413", "incidentTitle": "Microsoft Office Outlook: Outlook Improper Input Validation Vulnerability", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2025-02-06", "title": "CISA added CVE-2024-21413 to the KEV catalog (due 2025-02-27).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-office-outlook-cve-2024-21413" }, { "incident": "microsoft-net-framework-cve-2024-29059", "incidentTitle": "Microsoft .NET Framework: .NET Framework Information Disclosure Vulnerability", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-02-04", "title": "CISA added CVE-2024-29059 to the KEV catalog (due 2025-02-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-net-framework-cve-2024-29059" }, { "incident": "microsoft-windows-cve-2025-21333", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-01-14", "title": "CISA added CVE-2025-21333 to the KEV catalog (due 2025-02-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21333" }, { "incident": "microsoft-windows-cve-2025-21333", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-01-14", "title": "CISA added CVE-2025-21334 to the KEV catalog (due 2025-02-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21333" }, { "incident": "microsoft-windows-cve-2025-21333", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2025-01-14", "title": "CISA added CVE-2025-21335 to the KEV catalog (due 2025-02-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2025-21333" }, { "incident": "microsoft-windows-cve-2024-35250", "incidentTitle": "Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-16", "title": "CISA added CVE-2024-35250 to the KEV catalog (federal deadline 2025-01-06)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-35250" }, { "incident": "microsoft-windows-cve-2024-49138", "incidentTitle": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-10", "title": "CVE-2024-49138 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-49138", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-49138" }, { "incident": "microsoft-windows-cve-2024-49138", "incidentTitle": "Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-12-10", "title": "CISA added CVE-2024-49138 to the KEV catalog (federal deadline 2024-12-31)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-49138" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CVE-2024-43451 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43451", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CVE-2024-49039 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-49039", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CISA added CVE-2024-43451 to the KEV catalog (federal deadline 2024-12-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-zero-days-november-2024-43451-49039", "incidentTitle": "Microsoft November 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-11-12", "title": "CISA added CVE-2024-49039 to the KEV catalog (federal deadline 2024-12-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039" }, { "incident": "microsoft-sharepoint-cve-2024-38094", "incidentTitle": "Microsoft SharePoint Deserialization", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-22", "title": "CISA added CVE-2024-38094 to the KEV catalog (federal deadline 2024-11-12)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094" }, { "incident": "microsoft-windows-cve-2024-30088", "incidentTitle": "Microsoft Windows Kernel TOCTOU Race Condition", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-15", "title": "CISA added CVE-2024-30088 to the KEV catalog (federal deadline 2024-11-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-30088" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-43572 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43572", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CVE-2024-43573 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43573", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CISA added CVE-2024-43572 to the KEV catalog (federal deadline 2024-10-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-zero-days-october-2024-43572-43573", "incidentTitle": "Microsoft October 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-10-08", "title": "CISA added CVE-2024-43573 to the KEV catalog (federal deadline 2024-10-29)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573" }, { "incident": "microsoft-sql-server-cve-2020-0618", "incidentTitle": "Microsoft SQL Server Reporting Services Remote Code Execution", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-09-18", "title": "CISA added CVE-2020-0618 to the KEV catalog (federal deadline 2024-10-09)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sql-server-cve-2020-0618" }, { "incident": "microsoft-windows-cve-2024-43461", "incidentTitle": "Microsoft Windows MSHTML Platform Spoofing", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-16", "title": "CISA added CVE-2024-43461 to the KEV catalog (federal deadline 2024-10-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-43461" }, { "incident": "microsoft-windows-cve-2024-43461", "incidentTitle": "Microsoft Windows MSHTML Platform Spoofing", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-43461 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-43461", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-43461" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-38014 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38014", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-38217 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38217", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CVE-2024-38226 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38226", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CISA added CVE-2024-38014 to the KEV catalog (federal deadline 2024-10-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CISA added CVE-2024-38217 to the KEV catalog (federal deadline 2024-10-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-zero-days-september-2024-38014-38217-and-1-more", "incidentTitle": "Microsoft September 2024: 3 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-09-10", "title": "CISA added CVE-2024-38226 to the KEV catalog (federal deadline 2024-10-01)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more" }, { "incident": "microsoft-exchange-server-cve-2021-31196", "incidentTitle": "Microsoft Exchange Server Information Disclosure", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-21", "title": "CISA added CVE-2021-31196 to the KEV catalog (federal deadline 2024-09-11)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2021-31196" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38106 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38106", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38107 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38107", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38178 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38178", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38189 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38189", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38193 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38193", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CVE-2024-38213 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38213", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38106 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38107 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38178 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38189 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38193 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "microsoft-zero-days-august-2024-38106-38107-and-4-more", "incidentTitle": "Microsoft August 2024: 6 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-13", "title": "CISA added CVE-2024-38213 to the KEV catalog (federal deadline 2024-09-03)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more" }, { "incident": "crowdstrike-falcon-channel-file-291-outage", "incidentTitle": "CrowdStrike Falcon update crashes 8.5 million Windows machines", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-08-06", "title": "CrowdStrike publishes the Channel File 291 root cause analysis", "body": null, "sourceUrl": "https://www.crowdstrike.com/wp-content/uploads/2024/08/Channel-File-291-Incident-Root-Cause-Analysis-08.06.2024.pdf", "url": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage" }, { "incident": "microsoft-windows-cve-2018-0824", "incidentTitle": "Microsoft COM for Windows Deserialization of Untrusted Data", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-08-05", "title": "CISA added CVE-2018-0824 to the KEV catalog (federal deadline 2024-08-26)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2018-0824" }, { "incident": "microsoft-internet-explorer-cve-2012-4792", "incidentTitle": "Microsoft Internet Explorer Use-After-Free", "severity": "high", "status": "closed", "patchStatus": "unpatched", "date": "2024-07-23", "title": "CISA added CVE-2012-4792 to the KEV catalog (federal deadline 2024-08-13)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-internet-explorer-cve-2012-4792" }, { "incident": "crowdstrike-falcon-channel-file-291-outage", "incidentTitle": "CrowdStrike Falcon update crashes 8.5 million Windows machines", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-20", "title": "CrowdStrike publishes technical details; Microsoft estimates 8.5 million Windows devices affected", "body": null, "sourceUrl": "https://blogs.microsoft.com/blog/2024/07/20/helping-our-customers-through-the-crowdstrike-outage/", "url": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage" }, { "incident": "crowdstrike-falcon-channel-file-291-outage", "incidentTitle": "CrowdStrike Falcon update crashes 8.5 million Windows machines", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-19", "title": "04:09 UTC: CrowdStrike pushes the Channel File 291 update; Windows hosts crash", "body": null, "sourceUrl": "https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/", "url": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage" }, { "incident": "crowdstrike-falcon-channel-file-291-outage", "incidentTitle": "CrowdStrike Falcon update crashes 8.5 million Windows machines", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-07-19", "title": "05:27 UTC: the faulty update is remediated", "body": null, "sourceUrl": "https://www.crowdstrike.com/blog/falcon-update-for-windows-hosts-technical-details/", "url": "https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage" }, { "incident": "microsoft-sharepoint-cve-2024-38094", "incidentTitle": "Microsoft SharePoint Deserialization", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CVE-2024-38094 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38094", "url": "https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CVE-2024-38080 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38080", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CVE-2024-38112 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-38112", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CISA added CVE-2024-38080 to the KEV catalog (federal deadline 2024-07-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-zero-days-july-2024-38080-38112", "incidentTitle": "Microsoft July 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-07-09", "title": "CISA added CVE-2024-38112 to the KEV catalog (federal deadline 2024-07-30)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112" }, { "incident": "microsoft-windows-cve-2024-26169", "incidentTitle": "Microsoft Windows Error Reporting Service Improper Privilege Management", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-13", "title": "CISA added CVE-2024-26169 to the KEV catalog (federal deadline 2024-07-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-26169" }, { "incident": "microsoft-windows-cve-2024-30088", "incidentTitle": "Microsoft Windows Kernel TOCTOU Race Condition", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-11", "title": "CVE-2024-30088 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30088", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-30088" }, { "incident": "microsoft-windows-cve-2024-35250", "incidentTitle": "Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-06-11", "title": "CVE-2024-35250 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-35250", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-35250" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CVE-2024-30040 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30040", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CVE-2024-30051 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-30051", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CISA added CVE-2024-30040 to the KEV catalog (federal deadline 2024-06-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-zero-days-may-2024-30040-30051", "incidentTitle": "Microsoft May 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-05-14", "title": "CISA added CVE-2024-30051 to the KEV catalog (federal deadline 2024-06-04)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051" }, { "incident": "microsoft-smartscreen-prompt-cve-2024-29988", "incidentTitle": "Microsoft SmartScreen Prompt Security Feature Bypass", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-04-30", "title": "CISA added CVE-2024-29988 to the KEV catalog (federal deadline 2024-05-21)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-smartscreen-prompt-cve-2024-29988" }, { "incident": "microsoft-windows-cve-2022-38028", "incidentTitle": "Microsoft Windows Print Spooler Privilege Escalation", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-04-23", "title": "CISA added CVE-2022-38028 to the KEV catalog (federal deadline 2024-05-14)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2022-38028" }, { "incident": "microsoft-smartscreen-prompt-cve-2024-29988", "incidentTitle": "Microsoft SmartScreen Prompt Security Feature Bypass", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-04-09", "title": "CVE-2024-29988 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-29988", "url": "https://pwn.watch/i/microsoft-smartscreen-prompt-cve-2024-29988" }, { "incident": "microsoft-midnight-blizzard-corporate-email-breach", "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-04-02", "title": "CISA issues Emergency Directive 24-02 for agencies whose email with Microsoft was exposed", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/directives/ed-24-02-mitigating-significant-risk-nation-state-compromise-microsoft-corporate-email-system", "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach" }, { "incident": "microsoft-sharepoint-server-cve-2023-24955", "incidentTitle": "Microsoft SharePoint Server Code Injection", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-03-26", "title": "CISA added CVE-2023-24955 to the KEV catalog (federal deadline 2024-04-16)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955" }, { "incident": "microsoft-windows-cve-2024-26169", "incidentTitle": "Microsoft Windows Error Reporting Service Improper Privilege Management", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-03-12", "title": "CVE-2024-26169 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-26169", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-26169" }, { "incident": "microsoft-windows-cve-2024-21338", "incidentTitle": "Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-03-04", "title": "CISA added CVE-2024-21338 to the KEV catalog (federal deadline 2024-03-25)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-21338" }, { "incident": "microsoft-streaming-service-cve-2023-29360", "incidentTitle": "Microsoft Streaming Service Untrusted Pointer Dereference", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-29", "title": "CISA added CVE-2023-29360 to the KEV catalog (federal deadline 2024-03-21)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-streaming-service-cve-2023-29360" }, { "incident": "microsoft-exchange-server-cve-2024-21410", "incidentTitle": "Microsoft Exchange Server Privilege Escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-15", "title": "CISA added CVE-2024-21410 to the KEV catalog (federal deadline 2024-03-07)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2024-21410" }, { "incident": "microsoft-exchange-server-cve-2024-21410", "incidentTitle": "Microsoft Exchange Server Privilege Escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21410 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21410", "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2024-21410" }, { "incident": "microsoft-windows-cve-2024-21338", "incidentTitle": "Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21338 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21338", "url": "https://pwn.watch/i/microsoft-windows-cve-2024-21338" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21351 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21351", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CVE-2024-21412 published", "body": null, "sourceUrl": "https://nvd.nist.gov/vuln/detail/CVE-2024-21412", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CISA added CVE-2024-21351 to the KEV catalog (federal deadline 2024-03-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-zero-days-february-2024-21351-21412", "incidentTitle": "Microsoft February 2024: 2 actively exploited zero-days", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2024-02-13", "title": "CISA added CVE-2024-21412 to the KEV catalog (federal deadline 2024-03-05)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412" }, { "incident": "microsoft-midnight-blizzard-corporate-email-breach", "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-01-25", "title": "Microsoft publishes guidance for responders on the Midnight Blizzard attack", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/", "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach" }, { "incident": "microsoft-midnight-blizzard-corporate-email-breach", "incidentTitle": "Midnight Blizzard breaches Microsoft corporate email", "severity": "high", "status": "closed", "patchStatus": "no-fix-needed", "date": "2024-01-12", "title": "Microsoft detects a nation-state attack on its corporate systems", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2024/01/25/midnight-blizzard-guidance-for-responders-on-nation-state-attack/", "url": "https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach" }, { "incident": "microsoft-sharepoint-server-cve-2023-29357", "incidentTitle": "Microsoft SharePoint Server Privilege Escalation", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2024-01-10", "title": "CISA added CVE-2023-29357 to the KEV catalog (federal deadline 2024-01-31)", "body": null, "sourceUrl": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357" }, { "incident": "microsoft-windows-cve-2023-36584", "incidentTitle": "Microsoft Windows: Mark of the Web (MOTW) Security Feature Bypass (CVE-2023-36584)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-11-16", "title": "CISA added CVE-2023-36584 to the KEV catalog (due 2023-12-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36584" }, { "incident": "microsoft-windows-cve-2023-36025-36033-36036", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-11-14", "title": "CISA added CVE-2023-36025 to the KEV catalog (due 2023-12-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036" }, { "incident": "microsoft-windows-cve-2023-36025-36033-36036", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-11-14", "title": "CISA added CVE-2023-36033 to the KEV catalog (due 2023-12-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036" }, { "incident": "microsoft-windows-cve-2023-36025-36033-36036", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-11-14", "title": "CISA added CVE-2023-36036 to the KEV catalog (due 2023-12-05).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036" }, { "incident": "microsoft-skype-for-business-cve-2023-41763", "incidentTitle": "Microsoft Skype for Business: Privilege Escalation (CVE-2023-41763)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-10-10", "title": "CISA added CVE-2023-41763 to the KEV catalog (due 2023-10-31).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-skype-for-business-cve-2023-41763" }, { "incident": "microsoft-wordpad-cve-2023-36563", "incidentTitle": "Microsoft WordPad: Information Disclosure (CVE-2023-36563)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-10-10", "title": "CISA added CVE-2023-36563 to the KEV catalog (due 2023-10-31).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-wordpad-cve-2023-36563" }, { "incident": "microsoft-windows-cng-key-isolation-service-cve-2023-28229", "incidentTitle": "Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-10-04", "title": "CISA added CVE-2023-28229 to the KEV catalog (due 2023-10-25).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229" }, { "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023", "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-18", "title": "Public disclosure by Wiz and Microsoft", "body": null, "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023" }, { "incident": "microsoft-streaming-service-proxy-cve-2023-36802", "incidentTitle": "Microsoft Streaming Service Proxy: Privilege Escalation (CVE-2023-36802)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-09-12", "title": "CISA added CVE-2023-36802 to the KEV catalog (due 2023-10-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-streaming-service-proxy-cve-2023-36802" }, { "incident": "microsoft-word-cve-2023-36761", "incidentTitle": "Microsoft Word: Information Disclosure (CVE-2023-36761)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-09-12", "title": "CISA added CVE-2023-36761 to the KEV catalog (due 2023-10-03).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-word-cve-2023-36761" }, { "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-09-06", "title": "Microsoft: the key most likely leaked via a 2021 crash dump that reached its corporate network", "body": null, "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/results-of-major-technical-investigations-for-storm-0558-key-acquisition/", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023" }, { "incident": "microsoft-net-core-and-visual-studio-cve-2023-38180", "incidentTitle": "Microsoft .NET Core and Visual Studio: Denial-of-Service (CVE-2023-38180)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-08-09", "title": "CISA added CVE-2023-38180 to the KEV catalog (due 2023-08-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-net-core-and-visual-studio-cve-2023-38180" }, { "incident": "microsoft-windows-cve-2023-36884", "incidentTitle": "Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-17", "title": "CISA added CVE-2023-36884 to the KEV catalog (due 2023-08-29).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-36884" }, { "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-14", "title": "Microsoft details how the stolen MSA key was used to forge tokens", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/07/14/analysis-of-storm-0558-techniques-for-unauthorized-email-access/", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023" }, { "incident": "microsoft-outlook-cve-2023-35311", "incidentTitle": "Microsoft Outlook: Security Feature Bypass (CVE-2023-35311)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-11", "title": "CISA added CVE-2023-35311 to the KEV catalog (due 2023-08-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-outlook-cve-2023-35311" }, { "incident": "microsoft-windows-cve-2023-32046-32049-36874", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-11", "title": "CISA added CVE-2023-32046 to the KEV catalog (due 2023-08-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874" }, { "incident": "microsoft-windows-cve-2023-32046-32049-36874", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-11", "title": "CISA added CVE-2023-32049 to the KEV catalog (due 2023-08-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874" }, { "incident": "microsoft-windows-cve-2023-32046-32049-36874", "incidentTitle": "Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-07-11", "title": "CISA added CVE-2023-36874 to the KEV catalog (due 2023-08-01).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874" }, { "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-07-11", "title": "Microsoft discloses the intrusion; CISA and FBI publish AA23-193A", "body": null, "sourceUrl": "https://www.cisa.gov/news-events/cybersecurity-advisories/aa23-193a", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023" }, { "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023", "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-06-24", "title": "Microsoft revokes the SAS token", "body": null, "sourceUrl": "https://msrc.microsoft.com/blog/2023/09/microsoft-mitigated-exposure-of-internal-information-in-a-storage-account-due-to-overly-permissive-sas-token/", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023" }, { "incident": "microsoft-ai-research-sas-token-38tb-exposure-2023", "incidentTitle": "Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-06-22", "title": "Wiz reports the exposure to Microsoft", "body": null, "sourceUrl": "https://www.wiz.io/blog/38-terabytes-of-private-data-accidentally-exposed-by-microsoft-ai-researchers", "url": "https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023" }, { "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-06-16", "title": "Microsoft opens an investigation after a customer reports anomalous mail access", "body": null, "sourceUrl": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023" }, { "incident": "microsoft-storm-0558-forged-tokens-exchange-online-2023", "incidentTitle": "Storm-0558: stolen Microsoft signing key used to read government email", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-05-15", "title": "Storm-0558 begins accessing customer email with forged tokens", "body": null, "sourceUrl": "https://msrc.microsoft.com/blog/2023/07/microsoft-mitigates-china-based-threat-actor-storm-0558-targeting-of-customer-email/", "url": "https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023" }, { "incident": "microsoft-win32k-cve-2023-29336", "incidentTitle": "Microsoft Win32k: Privilege Escalation (CVE-2023-29336)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-05-09", "title": "CISA added CVE-2023-29336 to the KEV catalog (due 2023-05-30).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-win32k-cve-2023-29336" }, { "incident": "microsoft-windows-cve-2023-28252", "incidentTitle": "Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-04-11", "title": "CISA added CVE-2023-28252 to the KEV catalog (due 2023-05-02).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-28252" }, { "incident": "microsoft-outlook-ntlm-leak-cve-2023-23397", "incidentTitle": "Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-03-24", "title": "Microsoft publishes investigation guidance for CVE-2023-23397", "body": null, "sourceUrl": "https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/", "url": "https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397" }, { "incident": "microsoft-outlook-ntlm-leak-cve-2023-23397", "incidentTitle": "Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)", "severity": "critical", "status": "closed", "patchStatus": "patched", "date": "2023-03-14", "title": "Patch Tuesday fix; CISA adds CVE-2023-23397 to KEV", "body": null, "sourceUrl": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397", "url": "https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397" }, { "incident": "microsoft-windows-cve-2023-24880", "incidentTitle": "Microsoft Windows: SmartScreen Security Feature Bypass (CVE-2023-24880)", "severity": "medium", "status": "closed", "patchStatus": "patched", "date": "2023-03-14", "title": "CISA added CVE-2023-24880 to the KEV catalog (due 2023-04-04).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-24880" }, { "incident": "microsoft-office-cve-2023-21715", "incidentTitle": "Microsoft Office: Publisher Security Feature Bypass (CVE-2023-21715)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-14", "title": "CISA added CVE-2023-21715 to the KEV catalog (due 2023-03-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-office-cve-2023-21715" }, { "incident": "microsoft-windows-cve-2023-21823-23376", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-14", "title": "CISA added CVE-2023-21823 to the KEV catalog (due 2023-03-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376" }, { "incident": "microsoft-windows-cve-2023-21823-23376", "incidentTitle": "Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-02-14", "title": "CISA added CVE-2023-23376 to the KEV catalog (due 2023-03-07).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376" }, { "incident": "microsoft-exchange-server-cve-2022-41080", "incidentTitle": "Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-01-10", "title": "CISA added CVE-2022-41080 to the KEV catalog (due 2023-01-31).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080" }, { "incident": "microsoft-windows-cve-2023-21674", "incidentTitle": "Microsoft Windows: Advanced Local Procedure Call (ALPC) Privilege Escalation (CVE-2023-21674)", "severity": "high", "status": "closed", "patchStatus": "patched", "date": "2023-01-10", "title": "CISA added CVE-2023-21674 to the KEV catalog (due 2023-01-31).", "body": null, "sourceUrl": null, "url": "https://pwn.watch/i/microsoft-windows-cve-2023-21674" } ] }