# Microsoft security incidents · pwn.watch

> Security incidents tagged Microsoft (vendor, product, platform or attack type).

Page: https://pwn.watch/t/microsoft · generated 2026-10-22T16:23:59.585Z

## Status (as of 2026-10-22)
- Incidents: 93 (1 live, 1 live and not fully patched, 91 patched)
- Days without a Microsoft security incident: 0 (1 still unpatched, so the counter stays at 0)
- Newest incident started: 2026-10-17

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/microsoft.json
- RSS (every update): https://pwn.watch/t/microsoft/feed.xml
- This file: https://pwn.watch/t/microsoft/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [ConnectWise Cloud Backup shut down after M365 app-identity hijack](https://pwn.watch/i/connectwise-cloud-backup-m365-hijack) ([json](https://pwn.watch/i/connectwise-cloud-backup-m365-hijack.json)): critical, live, partial, started 2026-10-17
- [Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)](https://pwn.watch/i/windows-shell-cve-2026-96951-motw) ([json](https://pwn.watch/i/windows-shell-cve-2026-96951-motw.json)): high, closed, patched, started 2026-10-13, CVE-2026-96951, CVE-2026-108398, CVE-2026-92707
- [Microsoft SharePoint: Microsoft SharePoint Code Injection Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-65660.json)): high, closed, patched, started 2026-09-25, CVE-2026-65660
- [Microsoft Windows: Microsoft Windows Link Following Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-81963) ([json](https://pwn.watch/i/microsoft-windows-cve-2026-81963.json)): high, closed, patched, started 2026-09-08, CVE-2026-81963, CVE-2026-85880
- [Microsoft Internet Key Exchange (IKE) Service Extensions: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability](https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824) ([json](https://pwn.watch/i/microsoft-internet-key-exchange-ike-service-extensions-cve-2026-33824.json)): high, closed, patched, started 2026-08-18, CVE-2026-33824
- [Microsoft SharePoint: Microsoft SharePoint Weak Authentication Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-55040.json)): high, closed, patched, started 2026-08-18, CVE-2026-55040
- [Microsoft Windows Ancillary Function Driver for WinSock : Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability](https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820) ([json](https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820.json)): high, closed, patched, started 2026-08-11, CVE-2026-68820
- [Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ](https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-50522.json)): high, closed, patched, started 2026-07-22, CVE-2026-50522
- [Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-58644.json)): high, closed, patched, started 2026-07-16, CVE-2026-58644
- [Microsoft Active Directory Federation Services: Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ](https://pwn.watch/i/microsoft-active-directory-federation-services-cve-2026-56155) ([json](https://pwn.watch/i/microsoft-active-directory-federation-services-cve-2026-56155.json)): high, closed, patched, started 2026-07-14, CVE-2026-56155
- [Microsoft SharePoint Server: Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-56164.json)): high, closed, patched, started 2026-07-14, CVE-2026-56164
- [Microsoft SharePoint Server: Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-45659.json)): high, closed, patched, started 2026-07-01, CVE-2026-45659
- [Microsoft Defender: Microsoft Defender Link Following Vulnerability](https://pwn.watch/i/microsoft-defender-cve-2026-41091) ([json](https://pwn.watch/i/microsoft-defender-cve-2026-41091.json)): high, closed, patched, started 2026-05-20, CVE-2026-41091, CVE-2026-45498
- [Microsoft Microsoft: Microsoft Exchange Server Cross-Site Scripting Vulnerability](https://pwn.watch/i/microsoft-microsoft-cve-2026-42897) ([json](https://pwn.watch/i/microsoft-microsoft-cve-2026-42897.json)): high, closed, patched, started 2026-05-15, CVE-2026-42897
- [Microsoft Windows: Microsoft Windows Protection Mechanism Failure Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-32202) ([json](https://pwn.watch/i/microsoft-windows-cve-2026-32202.json)): high, closed, patched, started 2026-04-28, CVE-2026-32202
- [Microsoft Defender: Microsoft Defender Insufficient Granularity of Access Control Vulnerability](https://pwn.watch/i/microsoft-defender-cve-2026-33825) ([json](https://pwn.watch/i/microsoft-defender-cve-2026-33825.json)): high, closed, patched, started 2026-04-22, CVE-2026-33825
- [Microsoft SharePoint Server: Microsoft SharePoint Server Improper Input Validation Vulnerability](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2026-32201.json)): high, closed, patched, started 2026-04-14, CVE-2026-32201
- [Microsoft Windows: Microsoft Windows Link Following Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-60710) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-60710.json)): high, closed, patched, started 2026-04-13, CVE-2025-60710, CVE-2023-36424
- [Microsoft SharePoint: Microsoft SharePoint Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2026-20963.json)): high, closed, patched, started 2026-03-18, CVE-2026-20963
- [Stryker hit by Handala data-wiping attack](https://pwn.watch/i/stryker-handala-wiper-march) ([json](https://pwn.watch/i/stryker-handala-wiper-march.json)): unknown, closed, no-fix-needed, started 2026-03-12
- [Microsoft Office: Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability](https://pwn.watch/i/microsoft-office-cve-2026-21514) ([json](https://pwn.watch/i/microsoft-office-cve-2026-21514.json)): high, closed, patched, started 2026-02-10, CVE-2026-21514
- [Microsoft Windows: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-21513) ([json](https://pwn.watch/i/microsoft-windows-cve-2026-21513.json)): high, closed, patched, started 2026-02-10, CVE-2026-21513, CVE-2026-21525, CVE-2026-21510…
- [Microsoft Office: Microsoft Office Security Feature Bypass Vulnerability](https://pwn.watch/i/microsoft-office-cve-2026-21509) ([json](https://pwn.watch/i/microsoft-office-cve-2026-21509.json)): high, closed, patched, started 2026-01-26, CVE-2026-21509
- [Microsoft Windows: Microsoft Windows Information Disclosure Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-20805) ([json](https://pwn.watch/i/microsoft-windows-cve-2026-20805.json)): high, closed, patched, started 2026-01-13, CVE-2026-20805
- [Microsoft Windows: Windows Use After Free Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-62221) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-62221.json)): high, closed, patched, started 2025-12-09, CVE-2025-62221
- [Microsoft Windows: Windows Race Condition Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-62215) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-62215.json)): high, closed, patched, started 2025-11-12, CVE-2025-62215
- [Microsoft Windows: Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-59287) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-59287.json)): critical, closed, patched, started 2025-10-24, CVE-2025-59287
- [Microsoft Windows: Windows SMB Client Improper Access Control Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-33073) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-33073.json)): high, closed, patched, started 2025-10-20, CVE-2025-33073
- [Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-24990, CVE-2025-59230)](https://pwn.watch/i/microsoft-windows-cve-2025-24990) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-24990.json)): high, closed, patched, started 2025-10-14, CVE-2025-24990, CVE-2025-59230
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)](https://pwn.watch/i/microsoft-windows-cve-2011-3402) ([json](https://pwn.watch/i/microsoft-windows-cve-2011-3402.json)): critical, closed, patched, started 2025-10-06, CVE-2011-3402, CVE-2013-3918, CVE-2021-43226
- [Microsoft Internet Explorer: Internet Explorer Uninitialized Memory Corruption Vulnerability](https://pwn.watch/i/microsoft-internet-explorer-cve-2010-3962) ([json](https://pwn.watch/i/microsoft-internet-explorer-cve-2010-3962.json)): high, closed, patched, started 2025-10-06, CVE-2010-3962
- [Microsoft Internet Explorer: Internet Explorer Resource Management Errors Vulnerability](https://pwn.watch/i/microsoft-internet-explorer-cve-2013-3893) ([json](https://pwn.watch/i/microsoft-internet-explorer-cve-2013-3893.json)): high, closed, patched, started 2025-08-12, CVE-2013-3893
- [Microsoft Office: Office Excel Remote Code Execution Vulnerability](https://pwn.watch/i/microsoft-office-cve-2007-0671) ([json](https://pwn.watch/i/microsoft-office-cve-2007-0671.json)): high, closed, patched, started 2025-08-12, CVE-2007-0671
- [ToolShell: mass exploitation of on-prem SharePoint (CVE-2025-53770, CVE-2025-49704, CVE-2025-49706)](https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770) ([json](https://pwn.watch/i/toolshell-sharepoint-cve-2025-53770.json)): critical, closed, patched, started 2025-07-18, CVE-2025-49704, CVE-2025-49706, CVE-2025-53770
- [Microsoft Windows: Microsoft Windows External Control of File Name or Path Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-33053) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-33053.json)): high, closed, patched, started 2025-06-10, CVE-2025-33053
- [Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)](https://pwn.watch/i/microsoft-windows-cve-2025-30397) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-30397.json)): high, closed, patched, started 2025-05-13, CVE-2025-30397, CVE-2025-30400, CVE-2025-32701…
- [Microsoft Windows: Windows NTLM Hash Disclosure Spoofing Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-24054) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-24054.json)): medium, closed, patched, started 2025-04-17, CVE-2025-24054
- [Microsoft Windows: Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-29824) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-29824.json)): critical, closed, patched, started 2025-04-08, CVE-2025-29824
- [Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)](https://pwn.watch/i/microsoft-windows-cve-2025-24983) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-24983.json)): critical, closed, patched, started 2025-03-11, CVE-2025-24983, CVE-2025-24984, CVE-2025-24985…
- [Microsoft Windows: Windows Win32k Improper Resource Shutdown or Release Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2018-8639) ([json](https://pwn.watch/i/microsoft-windows-cve-2018-8639.json)): critical, closed, patched, started 2025-03-03, CVE-2018-8639
- [Microsoft Partner Center: Partner Center Improper Access Control Vulnerability](https://pwn.watch/i/microsoft-partner-center-cve-2024-49035) ([json](https://pwn.watch/i/microsoft-partner-center-cve-2024-49035.json)): high, closed, patched, started 2025-02-25, CVE-2024-49035
- [Microsoft Power Pages: Power Pages Improper Access Control Vulnerability](https://pwn.watch/i/microsoft-power-pages-cve-2025-24989) ([json](https://pwn.watch/i/microsoft-power-pages-cve-2025-24989.json)): high, closed, patched, started 2025-02-21, CVE-2025-24989
- [Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-21391, CVE-2025-21418)](https://pwn.watch/i/microsoft-windows-cve-2025-21391) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-21391.json)): high, closed, patched, started 2025-02-11, CVE-2025-21391, CVE-2025-21418
- [Microsoft Office Outlook: Outlook Improper Input Validation Vulnerability](https://pwn.watch/i/microsoft-office-outlook-cve-2024-21413) ([json](https://pwn.watch/i/microsoft-office-outlook-cve-2024-21413.json)): critical, closed, patched, started 2025-02-06, CVE-2024-21413
- [Microsoft .NET Framework: .NET Framework Information Disclosure Vulnerability](https://pwn.watch/i/microsoft-net-framework-cve-2024-29059) ([json](https://pwn.watch/i/microsoft-net-framework-cve-2024-29059.json)): high, closed, patched, started 2025-02-04, CVE-2024-29059
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)](https://pwn.watch/i/microsoft-windows-cve-2025-21333) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-21333.json)): high, closed, patched, started 2025-01-14, CVE-2025-21333, CVE-2025-21334, CVE-2025-21335
- [Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow](https://pwn.watch/i/microsoft-windows-cve-2024-49138) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-49138.json)): high, closed, patched, started 2024-12-10, CVE-2024-49138
- [Microsoft November 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039) ([json](https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039.json)): high, closed, patched, started 2024-11-12, CVE-2024-43451, CVE-2024-49039
- [Microsoft October 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573) ([json](https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573.json)): high, closed, patched, started 2024-10-08, CVE-2024-43572, CVE-2024-43573
- [Microsoft SQL Server Reporting Services Remote Code Execution](https://pwn.watch/i/microsoft-sql-server-cve-2020-0618) ([json](https://pwn.watch/i/microsoft-sql-server-cve-2020-0618.json)): critical, closed, patched, started 2024-09-18, CVE-2020-0618
- [Microsoft Windows MSHTML Platform Spoofing](https://pwn.watch/i/microsoft-windows-cve-2024-43461) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-43461.json)): high, closed, patched, started 2024-09-10, CVE-2024-43461
- [Microsoft September 2024: 3 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more) ([json](https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more.json)): high, closed, patched, started 2024-09-10, CVE-2024-38014, CVE-2024-38217, CVE-2024-38226
- [Microsoft Exchange Server Information Disclosure](https://pwn.watch/i/microsoft-exchange-server-cve-2021-31196) ([json](https://pwn.watch/i/microsoft-exchange-server-cve-2021-31196.json)): high, closed, patched, started 2024-08-21, CVE-2021-31196
- [Microsoft August 2024: 6 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more) ([json](https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more.json)): high, closed, patched, started 2024-08-13, CVE-2024-38106, CVE-2024-38107, CVE-2024-38178…
- [Microsoft COM for Windows Deserialization of Untrusted Data](https://pwn.watch/i/microsoft-windows-cve-2018-0824) ([json](https://pwn.watch/i/microsoft-windows-cve-2018-0824.json)): high, closed, patched, started 2024-08-05, CVE-2018-0824
- [Microsoft Internet Explorer Use-After-Free](https://pwn.watch/i/microsoft-internet-explorer-cve-2012-4792) ([json](https://pwn.watch/i/microsoft-internet-explorer-cve-2012-4792.json)): high, closed, unpatched, started 2024-07-23, CVE-2012-4792
- [CrowdStrike Falcon update crashes 8.5 million Windows machines](https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage) ([json](https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage.json)): critical, closed, patched, started 2024-07-19
- [Microsoft SharePoint Deserialization](https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094) ([json](https://pwn.watch/i/microsoft-sharepoint-cve-2024-38094.json)): high, closed, patched, started 2024-07-09, CVE-2024-38094
- [Microsoft July 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112) ([json](https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112.json)): high, closed, patched, started 2024-07-09, CVE-2024-38080, CVE-2024-38112
- [Microsoft Windows Kernel TOCTOU Race Condition](https://pwn.watch/i/microsoft-windows-cve-2024-30088) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-30088.json)): high, closed, patched, started 2024-06-11, CVE-2024-30088
- [Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference](https://pwn.watch/i/microsoft-windows-cve-2024-35250) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-35250.json)): high, closed, patched, started 2024-06-11, CVE-2024-35250
- [Microsoft May 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051) ([json](https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051.json)): high, closed, patched, started 2024-05-14, CVE-2024-30040, CVE-2024-30051
- [Microsoft Windows Print Spooler Privilege Escalation](https://pwn.watch/i/microsoft-windows-cve-2022-38028) ([json](https://pwn.watch/i/microsoft-windows-cve-2022-38028.json)): high, closed, patched, started 2024-04-23, CVE-2022-38028
- [Microsoft SmartScreen Prompt Security Feature Bypass](https://pwn.watch/i/microsoft-smartscreen-prompt-cve-2024-29988) ([json](https://pwn.watch/i/microsoft-smartscreen-prompt-cve-2024-29988.json)): high, closed, patched, started 2024-04-09, CVE-2024-29988
- [Microsoft SharePoint Server Code Injection](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-24955.json)): high, closed, patched, started 2024-03-26, CVE-2023-24955
- [Microsoft Windows Error Reporting Service Improper Privilege Management](https://pwn.watch/i/microsoft-windows-cve-2024-26169) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-26169.json)): high, closed, patched, started 2024-03-12, CVE-2024-26169
- [Microsoft Streaming Service Untrusted Pointer Dereference](https://pwn.watch/i/microsoft-streaming-service-cve-2023-29360) ([json](https://pwn.watch/i/microsoft-streaming-service-cve-2023-29360.json)): high, closed, patched, started 2024-02-29, CVE-2023-29360
- [Microsoft Exchange Server Privilege Escalation](https://pwn.watch/i/microsoft-exchange-server-cve-2024-21410) ([json](https://pwn.watch/i/microsoft-exchange-server-cve-2024-21410.json)): critical, closed, patched, started 2024-02-13, CVE-2024-21410
- [Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control](https://pwn.watch/i/microsoft-windows-cve-2024-21338) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-21338.json)): high, closed, patched, started 2024-02-13, CVE-2024-21338
- [Microsoft February 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412) ([json](https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412.json)): high, closed, patched, started 2024-02-13, CVE-2024-21351, CVE-2024-21412
- [Midnight Blizzard breaches Microsoft corporate email](https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach) ([json](https://pwn.watch/i/microsoft-midnight-blizzard-corporate-email-breach.json)): high, closed, no-fix-needed, started 2024-01-12
- [Microsoft SharePoint Server Privilege Escalation](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357) ([json](https://pwn.watch/i/microsoft-sharepoint-server-cve-2023-29357.json)): critical, closed, patched, started 2024-01-10, CVE-2023-29357
- [Microsoft Windows: Mark of the Web (MOTW) Security Feature Bypass (CVE-2023-36584)](https://pwn.watch/i/microsoft-windows-cve-2023-36584) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-36584.json)): medium, closed, patched, started 2023-11-16, CVE-2023-36584
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)](https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036.json)): high, closed, patched, started 2023-11-14, CVE-2023-36025, CVE-2023-36033, CVE-2023-36036
- [Microsoft Skype for Business: Privilege Escalation (CVE-2023-41763)](https://pwn.watch/i/microsoft-skype-for-business-cve-2023-41763) ([json](https://pwn.watch/i/microsoft-skype-for-business-cve-2023-41763.json)): medium, closed, patched, started 2023-10-10, CVE-2023-41763
- [Microsoft WordPad: Information Disclosure (CVE-2023-36563)](https://pwn.watch/i/microsoft-wordpad-cve-2023-36563) ([json](https://pwn.watch/i/microsoft-wordpad-cve-2023-36563.json)): medium, closed, patched, started 2023-10-10, CVE-2023-36563
- [Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)](https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229) ([json](https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229.json)): high, closed, patched, started 2023-10-04, CVE-2023-28229
- [Microsoft Streaming Service Proxy: Privilege Escalation (CVE-2023-36802)](https://pwn.watch/i/microsoft-streaming-service-proxy-cve-2023-36802) ([json](https://pwn.watch/i/microsoft-streaming-service-proxy-cve-2023-36802.json)): high, closed, patched, started 2023-09-12, CVE-2023-36802
- [Microsoft Word: Information Disclosure (CVE-2023-36761)](https://pwn.watch/i/microsoft-word-cve-2023-36761) ([json](https://pwn.watch/i/microsoft-word-cve-2023-36761.json)): medium, closed, patched, started 2023-09-12, CVE-2023-36761
- [Microsoft .NET Core and Visual Studio: Denial-of-Service (CVE-2023-38180)](https://pwn.watch/i/microsoft-net-core-and-visual-studio-cve-2023-38180) ([json](https://pwn.watch/i/microsoft-net-core-and-visual-studio-cve-2023-38180.json)): high, closed, patched, started 2023-08-09, CVE-2023-38180
- [Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)](https://pwn.watch/i/microsoft-windows-cve-2023-36884) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-36884.json)): high, closed, patched, started 2023-07-17, CVE-2023-36884
- [Microsoft Outlook: Security Feature Bypass (CVE-2023-35311)](https://pwn.watch/i/microsoft-outlook-cve-2023-35311) ([json](https://pwn.watch/i/microsoft-outlook-cve-2023-35311.json)): high, closed, patched, started 2023-07-11, CVE-2023-35311
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)](https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874.json)): high, closed, patched, started 2023-07-11, CVE-2023-32046, CVE-2023-32049, CVE-2023-36874
- [Microsoft AI researchers exposed 38TB via an over-permissive Azure SAS link](https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023) ([json](https://pwn.watch/i/microsoft-ai-research-sas-token-38tb-exposure-2023.json)): high, closed, patched, started 2023-06-22
- [Storm-0558: stolen Microsoft signing key used to read government email](https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023) ([json](https://pwn.watch/i/microsoft-storm-0558-forged-tokens-exchange-online-2023.json)): critical, closed, patched, started 2023-05-15
- [Microsoft Win32k: Privilege Escalation (CVE-2023-29336)](https://pwn.watch/i/microsoft-win32k-cve-2023-29336) ([json](https://pwn.watch/i/microsoft-win32k-cve-2023-29336.json)): high, closed, patched, started 2023-05-09, CVE-2023-29336
- [Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)](https://pwn.watch/i/microsoft-windows-cve-2023-28252) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-28252.json)): high, closed, patched, started 2023-04-11, CVE-2023-28252
- [Outlook zero-click NTLM hash leak used by Russian state hackers (CVE-2023-23397)](https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397) ([json](https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397.json)): critical, closed, patched, started 2023-03-14, CVE-2023-23397
- [Microsoft Windows: SmartScreen Security Feature Bypass (CVE-2023-24880)](https://pwn.watch/i/microsoft-windows-cve-2023-24880) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-24880.json)): medium, closed, patched, started 2023-03-14, CVE-2023-24880
- [Microsoft Office: Publisher Security Feature Bypass (CVE-2023-21715)](https://pwn.watch/i/microsoft-office-cve-2023-21715) ([json](https://pwn.watch/i/microsoft-office-cve-2023-21715.json)): high, closed, patched, started 2023-02-14, CVE-2023-21715
- [Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)](https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376.json)): high, closed, patched, started 2023-02-14, CVE-2023-21823, CVE-2023-23376
- [Microsoft Exchange Server: Privilege Escalation (CVE-2022-41080)](https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080) ([json](https://pwn.watch/i/microsoft-exchange-server-cve-2022-41080.json)): high, closed, patched, started 2023-01-10, CVE-2022-41080
- [Microsoft Windows: Advanced Local Procedure Call (ALPC) Privilege Escalation (CVE-2023-21674)](https://pwn.watch/i/microsoft-windows-cve-2023-21674) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-21674.json)): high, closed, patched, started 2023-01-10, CVE-2023-21674