Microsoft Patch Tuesday vulnerability dashboard
PatchaPalooza tracks 31,633 Microsoft vulnerabilities across 83 Patch Tuesday releases since January 2020, combining Microsoft's advisories with CISA KEV, EPSS, NVD, public exploits and detection rules.
Latest release: November 2026 Patch Tuesday
1,342 vulnerabilities, 48 critical, 1 exploited in the wild, 0 publicly disclosed.
| CVE | Title | Severity | CVSS | Impact | Status |
|---|---|---|---|---|---|
| CVE-2026-124194 | Microsoft Outlook Spoofing Vulnerability | Medium | 6.5 | Spoofing | Exploited |
| CVE-2026-112967 | Windows Xbox Live Networking Service Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-116928 | Windows Search Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-116945 | Microsoft SQL Server Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-119958 | Windows LDAP - Lightweight Directory Access Protocol Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-85844 | Windows Kerberos Elevation of Privilege Vulnerability | Critical | 9.8 | Elevation of Privilege | |
| CVE-2026-88218 | Windows DNS Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-88234 | Windows iSCSI Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-88243 | Windows DHCP Server Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-95882 | Microsoft DirectMusic Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-95901 | Microsoft DirectMusic Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-96067 | Microsoft Color Management Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-96078 | Microsoft Color Management Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-96157 | Microsoft Windows Media Foundation Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | |
| CVE-2026-118740 | Aspire Security Feature Bypass Vulnerability | Critical | 9.1 | Security Feature Bypass | |
| CVE-2026-95962 | Windows Virtual Filtering Platform (VFP) Remote Code Execution Vulnerability | Critical | 9 | Remote Code Execution | |
| CVE-2026-119990 | Azure OpenAI Elevation of Privilege Vulnerability | Critical | 9.8 | Elevation of Privilege | |
| CVE-2026-109469 | Entra Device Registration Elevation of Privilege Vulnerability | Critical | 10 | Elevation of Privilege | |
| CVE-2026-120002 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Critical | 9.9 | Elevation of Privilege | |
| CVE-2026-120779 | Visual Studio Code Remote Code Execution Vulnerability | Critical | 9.6 | Remote Code Execution | |
| CVE-2026-114162 | Microsoft Graph Elevation of Privilege Vulnerability | Critical | 9.1 | Elevation of Privilege | |
| CVE-2026-109454 | Microsoft Office SharePoint Spoofing Vulnerability | Critical | 9 | Spoofing | |
| CVE-2026-114146 | ASP.NET Core Elevation of Privilege Vulnerability | Critical | 9 | Elevation of Privilege | |
| CVE-2026-80095 | Microsoft Office SharePoint Elevation of Privilege Vulnerability | Critical | 9 | Elevation of Privilege | |
| CVE-2026-109467 | Azure DevOps Server Remote Code Execution Vulnerability | Critical | 9.9 | Remote Code Execution |
Showing 25 of 49.
Recently added to CISA KEV
| CVE | Title | Severity | CVSS | Impact | Status | Added to KEV | Release |
|---|---|---|---|---|---|---|---|
| CVE-2026-96951 | Windows Shell Security Feature Bypass Vulnerability | High | 8.8 | Security Feature Bypass | Exploited | October 2026 | |
| CVE-2026-65660 | Microsoft SharePoint Server Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | August 2026 | ||
| CVE-2026-85880 | Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | September 2026 | |
| CVE-2026-81963 | Windows Update Stack Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | September 2026 | |
| CVE-2026-55040 | Microsoft SharePoint Server Security Feature Bypass Vulnerability | Critical | 9.1 | Security Feature Bypass | July 2026 | ||
| CVE-2026-33824 | Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | April 2026 | ||
| CVE-2026-68820 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | High | 7 | Elevation of Privilege | Exploited | August 2026 | |
| CVE-2026-50522 | Microsoft SharePoint Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | July 2026 | ||
| CVE-2026-58644 | Microsoft SharePoint Remote Code Execution Vulnerability | Critical | 9.8 | Remote Code Execution | Exploited | July 2026 | |
| CVE-2026-56164 | Microsoft SharePoint Server Elevation of Privilege Vulnerability | Medium | 5.3 | Elevation of Privilege | Exploited | July 2026 | |
| CVE-2026-56155 | Active Directory Federation Services Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | July 2026 | |
| CVE-2026-45659 | Microsoft SharePoint Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | May 2026 | ||
| CVE-2026-45498 | Microsoft Defender Denial of Service Vulnerability | Medium | 4 | Denial of Service | Exploited | May 2026 | |
| CVE-2026-41091 | Microsoft Defender Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | Exploited | May 2026 | |
| CVE-2026-42897 | Microsoft Exchange Server Spoofing Vulnerability | High | 8.1 | Spoofing | Exploited | May 2026 |
Recently revised
| CVE | Title | Severity | CVSS | Impact | Status | Revised | Release |
|---|---|---|---|---|---|---|---|
| CVE-2026-119990 | Azure OpenAI Elevation of Privilege Vulnerability | Critical | 9.8 | Elevation of Privilege | November 2026 | ||
| CVE-2026-57083 | Windows Media Photo Codec Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | July 2026 | ||
| CVE-2026-57084 | Windows File Explorer Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | July 2026 | ||
| CVE-2026-62740 | Windows Imaging Component Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | August 2026 | ||
| CVE-2026-62877 | Windows Win32k Elevation of Privilege Vulnerability | High | 7.8 | Remote Code Execution | August 2026 | ||
| CVE-2026-69499 | Windows Imaging Component Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | September 2026 | ||
| CVE-2026-69576 | Graphic Fonts Elevation of Privilege Vulnerability | High | 7.8 | Elevation of Privilege | September 2026 | ||
| CVE-2026-69609 | Win32k Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | September 2026 | ||
| CVE-2026-73013 | Windows Imaging Component Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | September 2026 | ||
| CVE-2026-77491 | Windows GDI Information Disclosure Vulnerability | Medium | 5.5 | Information Disclosure | September 2026 | ||
| CVE-2026-88097 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | High | 8.1 | Edge - Chromium | September 2026 | ||
| CVE-2026-83831 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | October 2026 | ||
| CVE-2026-85890 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | October 2026 | ||
| CVE-2026-85897 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | October 2026 | ||
| CVE-2026-85898 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | High | 8.8 | Remote Code Execution | October 2026 |
Browse by product family
Open Source Software · Windows · ESU · Browser · Mariner · Microsoft Office · Developer Tools · Azure · SQL Server · Other · Microsoft Dynamics · Apps · Server Software · System Center · Exchange Server · Device