The CISA KEV Catalogue, Searchable
Every flaw attackers are known to be using: what it is, how bad, and what fixes it.
- Flaws on the list
- 1,779
- Added in 30 days
- 40
- Used in ransomware
- 361
- In web & server software
- 181
10 Nov 2026 Microsoft Office Security flaw
Product ui does not warn user of unsafe actions in Microsoft Office Outlook allows an unauthorized attacker to perform spoofing over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 24 Nov 2026 (still open)
- Weakness
- CWE-356
27 Oct 2026 Google Brotli Memory corruption
A buffer overflow vulnerability in the Brotli decoder (c/dec/decode.c) in Google Brotli versions 1.0.3 through 1.2.0 on all platforms allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream. Users need to update any Brotli libraries or binaries between 1.0.3 through 1.2.0 to the latest available version: 1.0.10 or 1.1.1 or 1.2.1.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- nodejs node.js 26.12.1, nodejs node.js 24.22.1, nodejs node.js 22.23.4, microsoft .net 10.0.14, microsoft .net 9.0.22 and 7 older
- CISA due date
- 10 Nov 2026
- Weakness
- CWE-252, CWE-787
13 Oct 2026 Microsoft Windows Command injection
Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.5761, microsoft windows server 2019 10.0.17763.9376, microsoft windows server 2016 10.0.14393.9612, microsoft windows 11 26h2 10.0.26300.9711, microsoft windows 11 26h1 10.0.28000.3231 and 7 older
- CISA due date
- 16 Oct 2026
- Weakness
- CWE-77
25 Sep 2026 Microsoft SharePoint Remote code execution
Improper control of generation of code ('code injection') in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20522
- CISA due date
- 28 Sep 2026
- Weakness
- CWE-94
8 Sep 2026 Microsoft Windows Memory corruption
Heap-based buffer overflow in Windows ALPC allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 10.0.20348.5622, microsoft windows server 2019 10.0.17763.9245, microsoft windows server 2016 10.0.14393.9512, microsoft windows 10 1809 10.0.17763.9245, microsoft windows 10 1607 10.0.14393.9512 and 2 older
- CISA due date
- 22 Sep 2026
- Weakness
- CWE-122, CWE-908
8 Sep 2026 Microsoft Windows Access control flaw
Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.33438, microsoft windows 11 26h1 10.0.28000.2954, microsoft windows 11 25h2 10.0.26200.9445, microsoft windows 11 24h2 10.0.26100.9445, microsoft windows 11 23h2 10.0.22631.7582
- CISA due date
- 22 Sep 2026
- Weakness
- CWE-59, CWE-284
26 Aug 2026 Microsoft SQL Server Input validation flaw
A remote code execution vulnerability exists in Microsoft SQL Server when it incorrectly handles processing of internal functions, aka 'Microsoft SQL Server Remote Code Execution Vulnerability'.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sql server 2017 14.0.3192.2, microsoft sql server 2017 14.0.2027.2, microsoft sql server 2016 13.0.5366.0, microsoft sql server 2016 13.0.5101.9, microsoft sql server 2016 13.0.4604.0 and 1 older
- CISA due date
- 29 Aug 2026
- Weakness
- CWE-20
18 Aug 2026 Microsoft SharePoint Authentication bypass
Weak authentication in Microsoft Office SharePoint allows an unauthorized attacker to bypass a security feature over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20434
- CISA due date
- 21 Aug 2026
- Weakness
- CWE-1390
18 Aug 2026 Microsoft Internet Key Exchange (IKE) Service Extensions Memory corruption
Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.2274, microsoft windows server 2022 10.0.20348.5020, microsoft windows server 2019 10.0.17763.8644, microsoft windows server 2016 10.0.14393.9060, microsoft windows 11 26h1 10.0.28000.1836 and 7 older
- CISA due date
- 21 Aug 2026
- Weakness
- CWE-415
11 Aug 2026 Microsoft Windows Ancillary Function Driver for WinSock Memory corruption
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.33222, microsoft windows server 2022 10.0.20348.5440, microsoft windows server 2019 10.0.17763.9115, microsoft windows server 2016 10.0.14393.9418, microsoft windows 11 26h1 10.0.28000.2704 and 7 older
- CISA due date
- 25 Aug 2026
- Weakness
- CWE-416
22 Jul 2026 Microsoft SharePoint Remote code execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20434
- CISA due date
- 25 Jul 2026
- Weakness
- CWE-502
16 Jul 2026 Microsoft SharePoint Remote code execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20434
- CISA due date
- 19 Jul 2026
- Weakness
- CWE-502
14 Jul 2026 Microsoft SharePoint Server Authentication bypass
Missing authentication for critical function in Microsoft Office SharePoint allows an unauthorized attacker to elevate privileges over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20434
- CISA due date
- 17 Jul 2026
- Weakness
- CWE-306
14 Jul 2026 Microsoft Active Directory Federation Services Access control flaw
Insufficient granularity of access control in Active Directory Federation Services (AD FS) allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.33158, microsoft windows server 2022 10.0.20348.5386, microsoft windows server 2019 10.0.17763.9020, microsoft windows server 2016 10.0.14393.9339, microsoft windows 10 1809 10.0.17763.9020 and 1 older
- CISA due date
- 28 Jul 2026
- Weakness
- CWE-1220
1 Jul 2026 Microsoft SharePoint Server Remote code execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20280
- CISA due date
- 4 Jul 2026
- Weakness
- CWE-502
20 May 2026 Microsoft Defender Denial of service
Microsoft Defender Denial of Service Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft defender antimalware platform 4.18.26040.7
- CISA due date
- 3 Jun 2026
- Weakness
- CWE-400
20 May 2026 Microsoft Defender Path traversal
Improper link resolution before file access ('link following') in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft malware protection engine 1.1.26040.8
- CISA due date
- 3 Jun 2026
- Weakness
- CWE-59
20 May 2026 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in the Peer Objects component (aka iepeers.dll) in Microsoft Internet Explorer 6, 6 SP1, and 7 allows remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object, as exploited in the wild in March 2010, aka "Uninitialized Memory Corruption Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 3 Jun 2026
- Weakness
- CWE-399
20 May 2026 Microsoft Internet Explorer Memory corruption
Use-after-free vulnerability in Microsoft Internet Explorer 6, 6 SP1, 7, and 8 on Windows 2000 SP4; Windows XP SP2 and SP3; Windows Server 2003 SP2; Windows Vista Gold, SP1, and SP2; Windows Server 2008 Gold, SP2, and R2; and Windows 7 allows remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object, related to incorrectly initialized memory and improper handling of objects in memory, as exploited in the wild in December 2009 and January 2010 during Operation Aurora, aka "HTML Object Memory Corruption Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 3 Jun 2026
- Weakness
- CWE-416
On Hacker News
Analysis of Aurora/Exploit-Comele20 May 2026 Microsoft DirectX Security flaw
Unspecified vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow in Microsoft DirectX 7.0 through 9.0c on Windows 2000 SP4, Windows XP SP2 and SP3, and Windows Server 2003 SP2 allows remote attackers to execute arbitrary code via a crafted QuickTime media file, as exploited in the wild in May 2009, aka "DirectX NULL Byte Overwrite Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 3 Jun 2026
- Weakness
- CWE-158
20 May 2026 Microsoft Windows Remote code execution
The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that triggers the overflow during path canonicalization, as exploited in the wild by Gimmiv.A in October 2008, aka "Server Service Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 3 Jun 2026
- Weakness
- CWE-94
15 May 2026 Microsoft Cross-site scripting
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft exchange server subscription edition 15.02.2562.043
- CISA due date
- 29 May 2026
- Weakness
- CWE-79
On Hacker News
Microsoft Exchange Server Spoofing Vulnerability New28 Apr 2026 Microsoft Windows Security flaw
Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.2274, microsoft windows server 2022 10.0.20348.5020, microsoft windows server 2019 10.0.17763.8644, microsoft windows server 2016 10.0.14393.9060, microsoft windows 11 26h1 10.0.28000.1836 and 7 older
- CISA due date
- 12 May 2026
- Weakness
- CWE-693
On Hacker News
CVE-2026-32202: Windows Shell Spoofing Vulnerability22 Apr 2026 Microsoft Defender Access control flaw
Insufficient granularity of access control in Microsoft Defender allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft defender antimalware platform 4.18.26030.3011
- CISA due date
- 6 May 2026
- Weakness
- CWE-1220
14 Apr 2026 Microsoft SharePoint Server Input validation flaw
Improper input validation in Microsoft Office SharePoint allows an unauthorized attacker to perform spoofing over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19725.20210
- CISA due date
- 28 Apr 2026
- Weakness
- CWE-20
14 Apr 2026 Microsoft Office Remote code execution
Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 28 Apr 2026
- Weakness
- CWE-94
13 Apr 2026 Microsoft Windows Path traversal
Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.7392, microsoft windows 11 25h2 10.0.26200.7392, microsoft windows 11 24h2 10.0.26100.7392
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-59
13 Apr 2026 Microsoft Windows Memory corruption
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.531, microsoft windows server 2022 10.0.20348.2091, microsoft windows server 2019 10.0.17763.5122, microsoft windows server 2016 10.0.14393.6452, microsoft windows 11 23h2 10.0.22631.2715 and 7 older
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-125
13 Apr 2026 Microsoft Exchange Server Remote code execution
Microsoft Exchange Server Remote Code Execution Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-502
13 Apr 2026 Microsoft Visual Basic for Applications (VBA) Security flaw
Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 27 Apr 2026
- Weakness
- CWE-426
18 Mar 2026 Microsoft SharePoint Remote code execution
Deserialization of untrusted data in Microsoft Office SharePoint allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft sharepoint server 16.0.19127.20442
- CISA due date
- 21 Mar 2026
- Weakness
- CWE-502
17 Feb 2026 Microsoft Windows Memory corruption
Stack-based buffer overflow in the CComVariant::ReadFromStream function in the Active Template Library (ATL), as used in the MPEG2TuneRequest ActiveX control in msvidctl.dll in DirectShow, in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, Vista Gold, SP1, and SP2, and Server 2008 Gold and SP2 allows remote attackers to execute arbitrary code via a crafted web page, as exploited in the wild in July 2009, aka "Microsoft Video ActiveX Control Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 10 Mar 2026
- Weakness
- CWE-119, CWE-121
12 Feb 2026 Microsoft Configuration Manager SQL injection
Microsoft Configuration Manager Remote Code Execution Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 5 Mar 2026
- Weakness
- CWE-89
10 Feb 2026 Microsoft Windows Privilege escalation
Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.32313, microsoft windows server 2022 23h2 10.0.25398.2149, microsoft windows server 2022 10.0.20348.4711, microsoft windows server 2019 10.0.17763.8389, microsoft windows server 2016 10.0.14393.8868 and 7 older
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-269
10 Feb 2026 Microsoft Windows Denial of service
Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.32313, microsoft windows server 2022 23h2 10.0.25398.2149, microsoft windows server 2022 10.0.20348.4711, microsoft windows server 2019 10.0.17763.8389, microsoft windows server 2016 10.0.14393.8868 and 7 older
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-476
10 Feb 2026 Microsoft Windows Memory corruption
Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.32313, microsoft windows server 2022 23h2 10.0.25398.2149, microsoft windows server 2022 10.0.20348.4711, microsoft windows server 2019 10.0.17763.8389, microsoft windows server 2016 10.0.14393.8868 and 7 older
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-843
10 Feb 2026 Microsoft Office Security flaw
Reliance on untrusted inputs in a security decision in Microsoft Office Word allows an unauthorized attacker to bypass a security feature locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-807
10 Feb 2026 Microsoft Windows Security flaw
Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.32313, microsoft windows server 2022 23h2 10.0.25398.2149, microsoft windows server 2022 10.0.20348.4711, microsoft windows server 2019 10.0.17763.8389, microsoft windows server 2016 10.0.14393.8868 and 7 older
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-693
10 Feb 2026 Microsoft Windows Security flaw
Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.32313, microsoft windows server 2022 23h2 10.0.25398.2149, microsoft windows server 2022 10.0.20348.4711, microsoft windows server 2019 10.0.17763.8389, microsoft windows server 2016 10.0.14393.8868 and 7 older
- CISA due date
- 3 Mar 2026
- Weakness
- CWE-693
26 Jan 2026 Microsoft Office Security flaw
Reliance on untrusted inputs in a security decision in Microsoft Office allows an unauthorized attacker to bypass a security feature locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 16 Feb 2026
- Weakness
- CWE-807
13 Jan 2026 Microsoft Windows Information disclosure
Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.7623, microsoft windows server 2022 23h2 10.0.25398.2092, microsoft windows server 2022 10.0.20348.4648, microsoft windows server 2019 10.0.17763.8276, microsoft windows server 2016 10.0.14393.8783 and 7 older
- CISA due date
- 3 Feb 2026
- Weakness
- CWE-200
7 Jan 2026 Microsoft Office Remote code execution
Microsoft Office PowerPoint 2000 SP3, 2002 SP3, and 2003 SP3, and PowerPoint in Microsoft Office 2004 for Mac, allows remote attackers to execute arbitrary code via a PowerPoint file with an OutlineTextRefAtom containing an an invalid index value that triggers memory corruption, as exploited in the wild in April 2009 by Exploit:Win32/Apptom.gen, aka "Memory Corruption Vulnerability."
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- CISA due date
- 28 Jan 2026
- Weakness
- CWE-94
9 Dec 2025 Microsoft Windows Memory corruption
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.7392, microsoft windows server 2022 23h2 10.0.25398.2025, microsoft windows server 2022 10.0.20348.4467, microsoft windows server 2019 10.0.17763.8146, microsoft windows 11 25h2 10.0.26200.7392 and 5 older
- CISA due date
- 30 Dec 2025
- Weakness
- CWE-416
12 Nov 2025 Microsoft Windows Memory corruption
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.7092, microsoft windows server 2022 23h2 10.0.25398.1965, microsoft windows server 2022 10.0.20348.4346, microsoft windows server 2019 10.0.17763.8027, microsoft windows 11 25h2 10.0.26200.7092 and 5 older
- CISA due date
- 3 Dec 2025
- Weakness
- CWE-362
24 Oct 2025 Microsoft Windows Remote code execution
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2025 10.0.26100.6905, microsoft windows server 2022 23h2 10.0.25398.1916, microsoft windows server 2022 10.0.20348.4297, microsoft windows server 2019 10.0.17763.7922, microsoft windows server 2016 10.0.14393.8524
- CISA due date
- 14 Nov 2025
- Weakness
- CWE-502
20 Oct 2025 Microsoft Windows Access control flaw
Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1665, microsoft windows server 2022 10.0.20348.3745, microsoft windows server 2019 10.0.17763.7434, microsoft windows server 2016 10.0.14393.8148, microsoft windows 11 24h2 10.0.26100.4270 and 7 older
- CISA due date
- 10 Nov 2025
- Weakness
- CWE-284
14 Oct 2025 Microsoft Windows Access control flaw
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1913, microsoft windows server 2022 10.0.20348.4294, microsoft windows server 2019 10.0.17763.7919, microsoft windows 11 25h2 10.0.26200.6899, microsoft windows 11 24h2 10.0.26100.6899 and 6 older
- CISA due date
- 4 Nov 2025
- Weakness
- CWE-284
14 Oct 2025 IGEL OS Weak cryptography
In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an unverified SquashFS image.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.7919, microsoft windows server 2016 10.0.14393.8519, igel os 11.01.100, microsoft windows 11 25h2 10.0.26200.6899, microsoft windows 11 24h2 10.0.26100.6899 and 7 older
- CISA due date
- 4 Nov 2025
- Weakness
- CWE-324
14 Oct 2025 Microsoft Windows Memory corruption
Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Windows. Microsoft recommends removing any existing dependencies on this hardware.
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2022 23h2 10.0.25398.1913, microsoft windows server 2022 10.0.20348.4294, microsoft windows server 2019 10.0.17763.7919, microsoft windows 11 25h2 10.0.26200.6899, microsoft windows 11 24h2 10.0.26100.6899 and 6 older
- CISA due date
- 4 Nov 2025
- Weakness
- CWE-822
6 Oct 2025 Microsoft Windows Security flaw
Windows Common Log File System Driver Elevation of Privilege Vulnerability
- What to do
- Apply the vendor's update or fix (see the vendor advisory below). If you can't, take it off the internet or stop using it until you can.
- Fixed in (NVD)
- microsoft windows server 2019 10.0.17763.2366, microsoft windows server 2016 10.0.14393.4825, microsoft windows server 2004 10.0.19041.1415, microsoft windows 11 21h2 10.0.22000.376, microsoft windows 10 2004 10.0.19041.1415 and 7 older
- CISA due date
- 27 Oct 2025
Know when it's your software
Get an email within half an hour when a flaw in your software is added. Free.
About the KEV Catalogue
What is the CISA KEV catalogue?
CISA's list of flaws attackers are known to be using. A flaw is added only with reliable evidence of attacks and a known fix.
Why does it matter more than the CVSS score?
Few CVEs are ever used in attacks. These are, so fix them first, whatever their score.
What is the due date?
The deadline for US federal agencies to fix it (BOD 26-04, which replaced BOD 22-01): as little as three days for recent entries. A sensible deadline for anyone.
Does it apply outside the US?
The deadlines don't, but the flaws are in software used everywhere. If you run it, it applies to you.
What does "used in ransomware" mean?
CISA knows ransomware groups have used the flaw.
How often is it updated?
CISA adds flaws several times a week. CVE Hawk checks hourly and alerts you within half an hour if it's your software.