Microsoft
Monthly
Privilege elevation in Microsoft Dynamics 365 Customer Insights allows an already-authenticated network attacker to gain higher privileges than their assigned role should permit, owing to improper privilege management (CWE-269). The flaw carries a CVSS 3.1 base score of 7.7 with a scope change, meaning the impact crosses the initial security boundary into other components. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA's SSVC assessment records no known exploitation, but a vendor patch is available.
Tampering via command injection affects Microsoft Outlook for iOS versions 1.0.0 through 5.2617.0, where a network-based attacker can craft content that, once the victim interacts with it, injects and executes unauthorized commands to alter data integrity. The vulnerability carries CVSS 7.4 (integrity-only impact, scope changed) and requires user interaction; there is no public exploit identified at time of analysis, and EPSS is very low at 0.04%. Note a source conflict: the CVE description names 'M365 Copilot' while the CPE and EUVD affected-version data point specifically to Outlook for iOS.
Remote code execution in Microsoft Dynamics 365 (on-premises) version 9.1 (and 9.0 builds prior to 9.1.44.15) allows an authenticated, high-privileged attacker to run arbitrary code over the network because the application executes with unnecessary privileges (CWE-250). Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.07%) and CISA SSVC records no known exploitation, so this is a high-CVSS but not currently exploited issue. The scope-changed CVSS 9.1 reflects that successful code execution can impact resources beyond the vulnerable component's original security authority.
Spoofing in Microsoft Office (Office LTSC for Mac 2021/2024 and Excel/Word for Android) lets an attacker with local access bypass access-control checks (CWE-284) to misrepresent content or its origin to a user. Microsoft has issued a patch; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), so this is a low-likelihood but high-technical-impact issue.
Privilege escalation in Microsoft Azure Logic Apps allows an authenticated attacker with low-level privileges to elevate their permissions over the network via improper access control (CWE-284). The CVSS 9.9 score is driven by a scope change (S:C), meaning a successful attack breaches the security boundary of the vulnerable component and impacts other resources with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and EPSS probability is low (0.06%), consistent with CISA SSVC rating exploitation as 'none'.
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from a session fixation weakness (CWE-384) that a remote, unauthenticated attacker can leverage to hijack a victim's authenticated session after the victim is lured into interacting with an attacker-supplied session identifier. The flaw carries a CVSS 8.8 rating with total confidentiality, integrity, and availability impact, but currently has no public exploit identified at time of analysis and a low EPSS score of 0.06% (18th percentile). Microsoft self-reported the issue and has shipped a fix, while CISA's SSVC framework records exploitation as 'none' and non-automatable.
Authentication bypass in Microsoft's SAML SSO plugins for Atlassian Jira (versions 1.0.0 through 1.3.2) and Confluence (versions 1.0.0 through 7.3.x) allows a remote, unauthenticated attacker to impersonate other users and elevate privileges over the network due to an incorrectly implemented authentication algorithm. Rated CVSS 9.1 with full confidentiality and integrity impact, the flaw is deemed automatable with total technical impact by CISA's SSVC framework, though EPSS remains low (0.12%) and no public exploit has been identified at time of analysis. A vendor patch is available.
Local privilege escalation in Microsoft's Azure Connected Machine Agent (versions 1.0.0 through 1.62) allows a low-privileged authenticated user on an Azure Arc-enabled machine to gain SYSTEM-level privileges by abusing an improper access control weakness. Microsoft has released a fixed build (1.63) and this is currently classified with no known exploitation (SSVC: none), consistent with an EPSS score of just 0.04%; no public exploit identified at time of analysis. The flaw is tagged as an authentication bypass and carries full technical impact (total) across confidentiality, integrity, and availability.
Privilege escalation in Windows Admin Center in Azure Portal (versions 1.0 up to but not including 2.6.7) lets an already-authenticated, low-privileged network user gain higher privileges by abusing improper access control (CWE-284). Microsoft reports a patch is available; there is no public exploit identified at time of analysis and EPSS probability is low (0.06%). Tagged as an authentication-bypass class issue, successful exploitation yields total control (high confidentiality, integrity, and availability impact) over the affected management surface.
Local privilege escalation in Microsoft Office Click-To-Run (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024) allows an authenticated local attacker to elevate privileges due to improper access control in the update/servicing component. A successful attack results in total compromise of confidentiality, integrity, and availability with a scope change beyond the vulnerable component. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%, 12th percentile), but the vendor rates technical impact as total.
Local privilege escalation in Microsoft Office Click-To-Run (the servicing/update engine behind Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024) lets an already-authenticated low-privileged user escalate to higher privileges on the host due to insufficiently granular access control (CWE-1220). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows a scope change with total confidentiality, integrity, and availability impact, meaning a successful attacker crosses a security boundary from the Office servicing context to the wider system. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none', so this is a serious-but-not-actively-exploited local EoP that should be patched on the normal accelerated cycle.
Local privilege elevation in Microsoft Office Click-To-Run (affecting Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024) lets an already-authenticated local attacker exploit a use-after-free memory corruption to gain higher privileges on the host. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS probability is negligible (0.04%) and CISA SSVC records exploitation status as none, indicating this is a patch-on-schedule issue rather than an emergency.
Remote denial of service in the Windows TCP/IP stack lets an unauthorized adjacent-network attacker crash affected systems by triggering a NULL pointer dereference (CWE-476) via crafted network traffic. Reported by Microsoft and patched across the Windows 10, Windows 11, and Windows Server 2012-2025 families, the flaw requires no authentication or user interaction but is limited to attackers on the same logical network segment. EPSS is low (0.14%, 34th percentile) and CISA SSVC lists exploitation as none, so this is a real-but-not-urgent patch item with no public exploit identified at time of analysis.
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-privileged user to execute arbitrary code in the kernel context via a heap-based buffer overflow. All currently supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) are affected. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.02%), but the total technical impact and low exploitation barrier make it a meaningful patch-priority for endpoint hardening.
Local privilege escalation in Microsoft Windows Hyper-V (Windows 11 22H3/23H2 and Windows Server 2022) stems from a use-after-free memory corruption flaw that lets an attacker executing code in a guest context elevate privileges with a scope-changing impact on the host. Microsoft has released fixed builds and rates this critical (CVSS 9.3, total technical impact per CISA SSVC), but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). The scope change (S:C) combined with the Hyper-V attack surface is consistent with a guest-to-host virtualization boundary escape.
Local denial of service in Microsoft Windows TCP/IP networking stack allows an unauthorized local attacker to trigger a null pointer dereference (CWE-476), crashing the system or causing broad service disruption. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. Reported by Microsoft, this is a crash/availability issue only - no code execution or data exposure - with no public exploit identified at time of analysis and a very low (0.05%) EPSS exploitation probability.
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authenticated low-privileged user to gain SYSTEM-level control across virtually all supported Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC rating exploitation as 'none'. The flaw is a serious defense-in-depth concern because it grants total confidentiality, integrity, and availability impact once a foothold exists, but it is not remotely reachable and requires prior local access.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user gain SYSTEM-level rights on affected Windows client and server builds by triggering an integer underflow (CWE-191) in the driver's log-file parsing. The flaw yields total confidentiality, integrity, and availability impact on the local machine. There is no public exploit identified at time of analysis, EPSS risk is low (0.06%, 19th percentile), and CISA SSVC records exploitation status as none - but CLFS is a historically heavily-targeted attack surface, so patching is warranted.
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated (typically SYSTEM-level) privileges across nearly all supported Windows client and server releases. Microsoft has released patches, and the flaw carries a total technical-impact rating (SSVC), though EPSS is very low (0.04%) and there is no public exploit identified at time of analysis. It is not on CISA KEV, indicating no confirmed active exploitation.
Local privilege escalation in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where an untrusted pointer dereference (CWE-822) lets an already-authenticated local attacker execute code with SYSTEM-level privileges. Microsoft has released a patch, and no public exploit is identified at time of analysis; EPSS exploitation probability is very low (0.03%) and the flaw is not on CISA KEV. Despite the 'Information Disclosure' tag applied in vendor metadata, the CVSS vector and description describe a privilege-elevation primitive with total confidentiality, integrity, and availability impact on the affected host.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.
Local code execution in Microsoft Word (and Office 2016/2019, LTSC 2021/2024, 365 Apps, Office for Mac, and SharePoint Server) stems from an untrusted pointer dereference (CWE-822) that lets an attacker run arbitrary code with the victim's privileges when a malicious file is processed. Microsoft rates it CVSS 8.4 with total technical impact (high confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC marks exploitation as none and not automatable, indicating no observed real-world attacks yet.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-privilege access to execute arbitrary code across the network by abusing insufficiently granular access controls (CWE-1220). The flaw carries a CVSS 8.8 rating with full confidentiality, integrity, and availability impact; however EPSS estimates only a 0.06% exploitation probability and CISA SSVC records no observed exploitation, so this is currently no public exploit identified at time of analysis. Microsoft has released patches for all affected editions.
Arbitrary code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019, LTSC 2021/2024, Office for Mac, and Office Online Server) is possible when a user opens a maliciously crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122), running attacker code in the context of the current user. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%, 18th percentile), but the technical impact is total (full confidentiality, integrity, and availability loss). Microsoft has released patches; exploitation requires the victim to open a file, so it is a phishing/social-engineering-driven local vulnerability rather than a remotely wormable one.
Local code execution in Microsoft Office Word (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory-corruption flaw that lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. Microsoft has released a patch, and no public exploit has been identified at time of analysis; EPSS is very low at 0.06% (18th percentile) and CISA SSVC records no known exploitation.
Local code execution in Microsoft Office Excel (Excel 2016, Office 2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a specially crafted spreadsheet. Successful exploitation yields full compromise of the current user's context (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records exploitation status as none, indicating this is a patch-in-cycle issue rather than an active threat.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory corruption (CWE-416) that lets an attacker run arbitrary code with the victim's privileges. Microsoft's CVSS vector rates it AV:L/PR:N/UI:N (base 8.4) with total technical impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.04%. A vendor patch is available from Microsoft (MSRC update guide).
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). An authorized user holding only low-level site privileges can escalate to full server compromise over the network with no user interaction. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none'; EPSS sits at 0.50% (66th percentile), indicating modest near-term exploitation probability despite the high CVSS 8.8 score.
Local privilege escalation in the Windows Link-Layer Discovery Protocol (LLDP) component affects a broad range of Windows client and server builds, where a CWE-415 double-free condition can be leveraged by an already-authenticated low-privileged user to gain higher privileges. The flaw was reported by Microsoft and is addressed in the July 2026 servicing updates; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is negligible (0.04%, 12th percentile), consistent with the high attack complexity (AC:H) and local-only vector.
Local privilege escalation in the Windows Projected File System (ProjFS) affects the full supported Windows line — Windows 10 (1809/21H2/22H2), Windows 11 (22H3 through 26H1), and Windows Server 2019/2022/2025 — where a use-after-free (CWE-416) lets an authenticated local user corrupt kernel/service memory and elevate to higher privileges. Microsoft-reported and patched, the flaw carries total technical impact per CISA SSVC but has no public exploit identified at time of analysis and a very low EPSS (0.04%). The high attack complexity (AV:L/AC:H) reflects a race-condition-style UAF that is non-trivial to win reliably.
Local privilege escalation in the Windows Telephony Service (TAPI) affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker can exploit a use-after-free (CWE-416) memory-corruption flaw to gain SYSTEM-level privileges; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 3.1 base score is 7.8 with total technical impact per CISA SSVC.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixes, but SSVC reports no observed exploitation and EPSS is very low (0.04%), so this is a patch-on-schedule kernel EoP rather than an emergency; no public exploit identified at time of analysis. Because Cloud Files underpins OneDrive/cloud sync placeholders, the driver is present on effectively every modern Windows install.
Local information disclosure in the Microsoft Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows 10, Windows 11 (through 26H1), and Windows Server (2016-2025) builds, where a buffer over-read (CWE-126) lets an already-authenticated local attacker read adjacent process memory. Microsoft's CVSS 7.8 vector rates full confidentiality, integrity, and availability impact even though the description characterizes the outcome as information disclosure, so the leaked memory could plausibly aid further local escalation. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and CISA SSVC marks exploitation as none, but a vendor patch is available.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an already-authenticated attacker to win a race condition and elevate to SYSTEM-level privileges across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). Exploitation requires local, low-privileged access rather than remote reach, and Microsoft rates the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), consistent with CISA SSVC marking exploitation as none and not automatable.
Remote code execution in Microsoft Windows Server 2025 kernel-mode drivers lets an authenticated attacker corrupt kernel memory via a use-after-free and run code with full system-level impact. Exploitation requires low-level privileges plus user interaction, and Microsoft has released a fix. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.06%).
Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) allows an authenticated low-privileged user to corrupt kernel/service memory through a double free (CWE-415) and elevate to SYSTEM. It affects a broad range of Windows client and server releases from Windows Server 2012/Windows 10 1607 through Windows 11 26H1 and Windows Server 2025 where the MSMQ feature is installed. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC records no known exploitation, though the technical impact is rated total.
Local privilege escalation in the Microsoft Windows TCP/IP stack (tcpip.sys) lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across virtually all supported Windows client and server releases. Microsoft assigns CVSS 7.8 and reports total technical impact, but SSVC exploitation status is 'none' and EPSS is only 0.06% (18th percentile), and there is no public exploit identified at time of analysis. Microsoft has released a patch via the Security Update Guide.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free memory-corruption condition. The flaw was reported by Microsoft and affects a broad range of Windows 10, Windows 11, and Windows Server builds; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.06%).
Spoofing in Microsoft Azure Machine Learning (versions 3.0.0 up to but not including 1.7.6) lets an unauthenticated network attacker inject improperly neutralized special elements into output rendered by a downstream component, enabling them to impersonate trusted content or identities against a victim who interacts with the malicious output. The CVSS 3.1 base score is 8.2 with a scope change and high confidentiality impact, but real-world urgency is tempered by an EPSS of just 0.05% (15th percentile) and CISA SSVC rating exploitation as 'none'. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Remote code execution in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker (PR:L) to run arbitrary code over the network by submitting maliciously crafted serialized data that the server deserializes without validation. Microsoft has released a patch and no public exploit identified at time of analysis; EPSS is modest at 0.50% (66th percentile) and CISA SSVC rates exploitation as 'none' but technical impact as 'total'. The bug follows the well-known SharePoint deserialization RCE pattern (CWE-502), making it a high-value target for post-authentication lateral movement and full server compromise.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker to run arbitrary code across the network by submitting maliciously crafted serialized data (CWE-502). Any user holding low-privilege authenticated access to the SharePoint web application can achieve total compromise of the server (C:H/I:H/A:H). There is no public exploit identified at time of analysis, and the EPSS probability is modest at 0.50% (66th percentile), but the impact is total and a vendor patch is already available.
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted network requests that trigger a loop with an unreachable exit condition (CWE-835), pinning CPU and rendering the application unresponsive. Publicly available exploit code exists, though there is no public exploit identified as being used in active attacks; EPSS is very low (0.04%, 12th percentile), consistent with the CISA SSVC 'Exploitation: none' assessment. Microsoft has released fixed runtime packages, and the flaw is availability-only with no confidentiality or integrity impact.
Remote code execution in Microsoft Dynamics 365 (on-premises) versions 9.0 and 9.1 (prior to 9.1.44.15) lets an authenticated attacker inject and execute arbitrary code across the network with a scope change beyond the vulnerable component. Rated CVSS 9.9, the flaw yields total confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.07%, 21st percentile). Microsoft has released a fixed build (9.1.44.15).
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where an integer overflow (CWE-190) lets an already-authenticated low-privileged user run code with SYSTEM-level rights. Microsoft has released a patch and reported the flaw itself; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.06%). SSVC rates exploitation as none but technical impact as total, marking it a classic patch-Tuesday local EoP rather than a mass-exploitation threat.
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated, low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated privileges across virtually all supported Windows client and server builds. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is negligible (0.04%) and CISA's SSVC rates exploitation as none, indicating this is a defense-in-depth fix rather than an emergency. The flaw is high-value as a post-compromise escalation primitive but requires local code execution and winning a race condition to trigger.
Information disclosure in Microsoft Edge (Chromium-based) before 148.0.3967.55 allows a remote, unauthenticated attacker to read data they should not have access to by luring a victim into interacting with malicious web content. Rooted in external control of a file name or path (CWE-73) with a changed CVSS scope, it can leak sensitive information across security boundaries. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Local code execution in Microsoft Office (LTSC for Mac 2021/2024 and Office for Android) via a heap-based buffer overflow (CWE-122) that an unauthorized attacker triggers when a victim opens a maliciously crafted document, yielding full confidentiality, integrity, and availability impact in the user's context. Exploitation requires user interaction (UI:R) and local access (AV:L), so weaponization depends on social engineering rather than remote reachability. This is no public exploit identified at time of analysis, with a very low EPSS score of 0.06% and CISA SSVC rating exploitation as 'none', indicating no observed activity despite the 'total' technical impact.
Remote code execution in the Windows Native WiFi Miniport Driver allows an unauthorized attacker on an adjacent network to win a timing race and run arbitrary code on affected Windows 10, Windows 11, and Windows Server systems. The flaw stems from improper synchronization of a shared resource in the kernel-mode wireless driver and carries a total (C:H/I:H/A:H) technical impact. No public exploit has been identified and EPSS is very low (0.07%), but successful exploitation grants full kernel-level compromise without authentication.
Local code execution in Microsoft Visual Studio Code before 1.119.1 stems from improper neutralization of script-related HTML tags (basic XSS, CWE-80) rendered within the editor's webview surfaces, letting an attacker who tricks a user into opening crafted content run code in the victim's context. Exploitation requires user interaction (opening a malicious file/workspace) and is reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and EPSS is negligible at 0.05% (16th percentile).
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a remote, unauthenticated attacker inject unneutralized special elements into a downstream component (CWE-74) to defeat a built-in protection, provided a developer is lured into a triggering action (UI:R). With CVSS 8.8 and full confidentiality/integrity/availability impact, successful exploitation could subvert Copilot/editor security controls; however there is no public exploit identified at time of analysis, EPSS is low (0.06%), and CISA SSVC records exploitation status as none.
Spoofing in Microsoft PowerPoint for Android (versions 16.0.0.0 through 16.0.19822.20189) lets an authorized local attacker misrepresent content or identity by abusing improper access control (CWE-284). The flaw requires low-privilege local access and no user interaction per the CVSS vector, and there is no public exploit identified at time of analysis; EPSS is very low at 0.04% (12th percentile) and CISA SSVC scores exploitation as 'none', indicating no observed activity despite a 'total' technical-impact rating. Microsoft has released a fixed build.
Spoofing in Microsoft Word for Android (versions 16.0.0.0 up to but excluding 16.0.19822.20190) stems from an improper access control weakness (CWE-284) that an already-authorized local attacker can abuse to misrepresent content or identity. The CVSS 3.1 vector (AV:L/PR:L) confirms a local, low-privileged authenticated attacker is required, and SSVC rates technical impact as total despite no listed availability impact. There is no public exploit identified at time of analysis, EPSS is a very low 0.04% (12th percentile), and it is not on the CISA KEV list.
Remote code execution in Microsoft Windows DNS lets an unauthenticated attacker corrupt heap memory over the network and run arbitrary code on affected Windows 11 (22H3 through 26H1) and Windows Server 2022/2025 systems. The flaw is a CWE-122 heap-based buffer overflow rated CVSS 9.8, reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), so this is a high-severity but not-yet-exploited issue. CISA SSVC flags it as automatable with total technical impact, meaning successful exploitation fully compromises the host.
Local privilege escalation in the Windows Server Data Deduplication feature (dedup.sys / associated services) lets an authenticated low-privileged user corrupt kernel memory to gain SYSTEM-level rights. Reported by Microsoft across Windows Server 2012 R2 through 2025, it carries a CVSS 7.8 and total technical impact per CISA SSVC, but has no public exploit identified at time of analysis and a very low EPSS of 0.04% (13th percentile). It is not listed in CISA KEV and shows no evidence of active exploitation.
Remote code execution in Microsoft Data Formulator versions prior to 0.7 lets an unauthorized attacker run arbitrary code by inducing a user to interact with malicious content (CWE-94 code injection). The flaw is network-reachable and requires no authentication, but does require user interaction (CVSS 3.1 8.8, AV:N/UI:R). A vendor patch is available; there is no public exploit identified at time of analysis and EPSS probability is very low (0.06%).
Remote code execution in the Windows Netlogon service (across Windows Server 2012 through 2025) allows an unauthenticated attacker to run arbitrary code over the network by triggering a stack-based buffer overflow (CWE-121). With a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N and total technical impact, this is a critical, pre-authentication server-side flaw. Microsoft has released patches; publicly available exploit code exists, though EPSS remains low (0.09%) and there is no confirmed active exploitation at time of analysis.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticated low-privileged user to elevate to SYSTEM across Windows 10, Windows 11 (21H2 through 26H1), and Windows Server 2022/2025. The flaw stems from external control of a file name or path (CWE-73) inside the kernel-mode WinSock support driver, yielding total confidentiality, integrity, and availability impact per CVSS 7.8. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC records exploitation as none, but the total technical impact and near-universal Windows footprint make it a standard Patch Tuesday priority.
Local privilege elevation in Microsoft Office (Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024) stems from a use-after-free memory corruption flaw (CWE-416) that an already-authorized local attacker can trigger to gain higher privileges on the host. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.04%, 13th percentile) and CISA SSVC records exploitation as none, indicating no observed in-the-wild activity. The CVSS 3.1 base score is 7.8 with total technical impact (C:H/I:H/A:H) once triggered.
Local privilege escalation in Microsoft Dynamics 365 Business Central (2024 Release Wave 2 through 2026 Release Wave 1) lets an already-authenticated, low-privileged user elevate to higher privileges on the host through a weak authentication mechanism (CWE-1390). Successful exploitation yields total compromise of confidentiality, integrity, and availability of the affected instance. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as 'none' with an EPSS of just 0.04% (12th percentile), indicating low near-term exploitation likelihood.
Remote code execution in the Microsoft Windows TCP/IP stack allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on a wide range of Windows 10, Windows 11, and Windows Server builds. The flaw carries CVSS 8.1 but requires winning a memory-corruption race (AC:H), and there is no public exploit identified at time of analysis; EPSS is very low at 0.09% and CISA SSVC lists exploitation as none. A vendor patch is available from Microsoft.
Denial of service in the Microsoft Windows TCP/IP networking stack allows an unauthenticated, adjacent-network attacker to crash the host by triggering a null pointer dereference (CWE-476) during packet processing, with no user interaction required. The flaw affects essentially the entire supported Windows client and server lineup, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, and the low EPSS score (0.14%) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation despite the broad footprint.
Local privilege escalation in the Microsoft Windows SMB Client (mrxsmb/rdbss) driver lets a low-privileged, authenticated user corrupt kernel memory through a use-after-free (CWE-416) and elevate to SYSTEM. The flaw affects a broad range of Windows client and server builds from Windows Server 2012 R2 through Windows 11 25H2/26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none' - but technical impact is 'total', so it remains a meaningful patch-Tuesday-class local EoP.
Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an already-authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025 are affected, but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). Microsoft has released patches and CISA's SSVC framework rates exploitation as 'none' with total technical impact.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Server 2012 through Server 2025). Exploitation is CVSS 7.8 with total technical impact per CISA SSVC, but SSVC records no observed exploitation and EPSS is very low (0.04%), and no public exploit was identified at time of analysis. A vendor patch is available from Microsoft (MSRC).
Information disclosure in the Windows TCP/IP networking stack allows a remote, unauthenticated attacker to read sensitive memory contents over the network by triggering a use-after-free condition. All supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025) are affected. Microsoft-reported with no public exploit identified at time of analysis; EPSS is low (0.06%, 19th percentile) and CISA SSVC records exploitation status as none.
Denial of service in the Microsoft Windows TCP/IP stack (Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows a remote, unauthenticated attacker to crash the affected system by triggering a null pointer dereference over the network. No public exploit has been identified at time of analysis and the EPSS probability is low (0.14%, 34th percentile), but the flaw is network-reachable with no privileges or user interaction and CISA SSVC rates it automatable. Impact is limited to availability - no code execution or data disclosure.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an authorized (low-privileged) attacker to run code with SYSTEM-level rights by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases and carries a CVSS 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, EPSS is very low (0.06%, 19th percentile), and it is not listed in CISA KEV, indicating no observed exploitation to date.
Local privilege escalation in Windows Cryptographic Services lets an authenticated low-privileged user corrupt heap memory (CWE-122) to gain SYSTEM-level control across supported Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total, and Microsoft has released patches. Because it requires prior local access, it is a post-compromise escalation primitive rather than an initial-access threat.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-level site privileges to run arbitrary code across the network by submitting maliciously crafted serialized data (CWE-502). Microsoft has released a patch; there is no public exploit identified at time of analysis, and the EPSS score is low (0.31%, 55th percentile), with CISA's SSVC framework rating exploitation status as 'none' but technical impact as 'total'. The combination of authenticated-but-low privilege access and full compromise of confidentiality, integrity, and availability makes this a meaningful escalation-to-RCE risk in enterprise collaboration environments.
Local code execution in Microsoft Word (and the Office suites that bundle it - Office 2016/2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) stems from a use-after-free memory-corruption defect that lets an attacker run arbitrary code in the context of the current user, typically by having the victim process a crafted document. Microsoft (the reporting party) has released a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile). SSVC rates exploitation as none but technical impact as total, so this is a patch-on-schedule item rather than an emergency.
Local code execution in Microsoft Word (Office 2016 through Office LTSC 2024, Microsoft 365 Apps, and Office for Mac) results from a type-confusion flaw (CWE-843) that lets an unauthorized attacker run arbitrary code with the victim's privileges. Microsoft rates it CVSS 8.4 with total technical impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 35th percentile). CISA SSVC records exploitation status as none and the issue is not automatable, indicating no observed in-the-wild activity.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps for Enterprise, Office for Android, and Office LTSC for Mac 2021/2024) stems from a heap-based buffer overflow that lets an attacker run arbitrary code with the victim's privileges. The flaw was reported by Microsoft, a vendor patch is available, and there is no public exploit identified at time of analysis; EPSS is very low at 0.04% and CISA SSVC records exploitation as none. Impact is total (full confidentiality, integrity, and availability loss) but exploitation is not automatable and, per typical Office file-parsing bugs, hinges on processing attacker-supplied content.
Information disclosure in Microsoft Excel (and the broader Office family - Office 2019, Office LTSC 2021/2024, Office for Mac, Microsoft 365 Apps for Enterprise, and Office Online Server) allows an attacker to read memory beyond an allocated buffer when a victim opens a crafted spreadsheet, potentially leaking sensitive in-process data. Exploitation is local and requires user interaction (opening the malicious file); there is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none'. EPSS is very low (0.06%, 18th percentile), indicating negligible observed exploitation activity, though the technical impact is rated 'total'.
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) allows an authenticated attacker to run arbitrary code over the network by supplying maliciously crafted serialized data (CWE-502). Any user holding valid low-privilege credentials on the SharePoint farm can achieve total compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is a modest 0.50% (66th percentile).
Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated, low-privileged network user to gain higher privileges by exploiting a missing authorization check (CWE-862). Successful exploitation yields high integrity and availability impact with limited confidentiality disclosure. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), but the CVSS base score of 8.3 and 'total' SSVC technical impact make it a meaningful risk in environments where WAC is exposed.
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an attacker to run code at a higher privilege level after a targeted user opens crafted input. The root cause combines improper input validation (CWE-20) with a heap-based buffer overflow (CWE-122), yielding total technical impact per CISA SSVC. Publicly available exploit code exists, but the vulnerability is not in CISA KEV and EPSS is low (0.11%, 30th percentile), indicating no observed widespread exploitation to date.
Denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows remote unauthenticated attackers to exhaust host memory across all supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The flaw is a memory leak (CWE-401) triggered over the network with no privileges or user interaction, but impact is limited to availability with no data exposure. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.08%, 23rd percentile).
Local code execution in the Windows Graphics Device Interface (GDI) component affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. An attacker who convinces a user to open a maliciously crafted file or content triggers a heap-based buffer overflow (CWE-122) in GDI, running arbitrary code in the victim's context with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records no known exploitation, so this is a patch-on-cycle item rather than an emergency.
Local privilege escalation in the Windows Kernel affects a broad range of Windows Server releases (2012 through 2025, including Server Core installations), where a heap-based buffer overflow (CWE-122) lets an already-authenticated local user corrupt kernel heap memory to gain SYSTEM-level privileges. Microsoft has released patches and rates it CVSS 7.8; there is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as none but technical impact as total. EPSS is very low (0.04%, 13th percentile), consistent with the local-only attack vector that requires prior code execution on the host.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an already-authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across supported Windows 10, Windows 11 (through 26H1) and Windows Server 2019-2025 builds. Microsoft has released fixes; there is no public exploit identified at time of analysis, EPSS risk is very low (0.04%), and it is not listed in CISA KEV. Despite 'Denial Of Service' tagging, the CVSS vector rates full confidentiality, integrity and availability impact, consistent with a kernel EoP.
Local privilege escalation in the Windows Win32K kernel-mode subsystem (ICOMP component) lets an already-authenticated low-privileged attacker gain SYSTEM-level control across a broad range of supported Windows client and server builds. The flaw is a type-confusion (CWE-843) memory-corruption issue reported by Microsoft; there is no public exploit identified at time of analysis and the EPSS probability is low (0.11%), but SSVC rates the technical impact as total. This is a standard Patch-Tuesday-class kernel EoP whose value is as the second stage of an intrusion after an attacker already has a foothold.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows low-privileged authenticated users to execute arbitrary code with SYSTEM privileges via use-after-free memory corruption. Microsoft has released patches addressing Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2012. CVSS base score is 7.0 (High) with local attack vector and high attack complexity. EPSS data not available; no CISA KEV listing at time of analysis, suggesting exploitation has not been observed in the wild despite public disclosure.
Local privilege escalation in Windows Storage Spaces Controller enables authenticated users with low-level access to gain SYSTEM-level privileges by exploiting an integer overflow that leads to memory corruption. Affects Windows 10 (1607 through 22H2), Windows 11 (all versions through 26H1), and Windows Server 2012 R2. Microsoft has released security updates through their March 2026 Patch Tuesday. No active exploitation confirmed in CISA KEV at time of analysis, though the combination of low attack complexity (AC:L) and no user interaction requirement (UI:N) makes post-compromise exploitation straightforward for attackers who have already obtained initial access.
Local privilege escalation in Windows TCP/IP stack affects Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server 2012 through a race condition vulnerability. Low-complexity exploitation requires only low-privilege authenticated access with no user interaction (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Vendor-released patch available from Microsoft Security Response Center. No public exploit code or active exploitation confirmed at time of analysis, though the low attack complexity and local vector suggest feasibility for post-compromise privilege escalation in enterprise environments.
Local privilege escalation in Windows Win32K graphics subsystem (Win32K - GRFX) allows authenticated users with low privileges to achieve SYSTEM-level access through a use-after-free memory corruption vulnerability. Affects multiple Windows 10, Windows 11, and Windows Server 2012 versions. Microsoft has released patches through their March 2026 security updates. The CVSS 7.0 (High) rating reflects high attack complexity (AC:H), requiring specific race condition timing or system state manipulation, though EPSS data is not yet available for this recently disclosed CVE.
Race condition in Windows Ancillary Function Driver for WinSock (AFD.sys) enables local privilege escalation for low-privileged authenticated users across Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server 2016. Microsoft confirmed the vulnerability and released patches via their March 2026 security updates. The flaw requires high attack complexity (CVSS AC:H), suggesting exploitation depends on winning a narrow timing window in concurrent socket operations. EPSS data unavailable, no CISA KEV listing at time of analysis, but Microsoft's rapid patch indicates credible exploit risk.
Type confusion vulnerability in Windows Ancillary Function Driver for WinSock enables local authenticated users to escalate privileges to SYSTEM level on Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012. Microsoft has released patches through their March 2026 security update cycle. The vulnerability requires low-privilege local access but no user interaction, making it a high-value target for post-compromise lateral movement and persistence. CVSS 7.8 reflects complete system compromise potential, though EPSS data and KEV status are not available for this future-dated CVE.
Local privilege escalation in Windows Application Identity (AppID) Subsystem allows low-privileged authenticated users to execute code as SYSTEM via heap buffer overflow. Microsoft has released security patches across Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012. CVSS 7.8 score reflects high impact to confidentiality, integrity, and availability. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. Requires existing local access with standard user privileges, limiting remote attack surface.
Local privilege escalation in Windows Print Spooler Components affects Windows 10, Windows 11, and Windows Server 2012 through race condition exploitation. Authenticated low-privileged attackers can elevate to SYSTEM privileges via concurrent resource access attacks, though attack complexity is rated high (AC:H). Vendor-released patch available from Microsoft Security Response Center. No active exploitation confirmed in CISA KEV at time of analysis, but Print Spooler remains a historically attractive target with established attack patterns (PrintNightmare, SpoolFool precedents).
Local privilege escalation in Windows Win32K graphics subsystem affects Windows 10 (1607 through 22H2), Windows 11 (all versions including 26H1 preview), and Windows Server 2012 through authenticated low-privileged local users exploiting a use-after-free memory corruption flaw. Microsoft has released security updates addressing this CWE-416 vulnerability with CVSS 7.8 severity. The local attack vector and low complexity (AC:L) indicate straightforward exploitation once local access is achieved, though no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.
Privilege elevation in Microsoft Dynamics 365 Customer Insights allows an already-authenticated network attacker to gain higher privileges than their assigned role should permit, owing to improper privilege management (CWE-269). The flaw carries a CVSS 3.1 base score of 7.7 with a scope change, meaning the impact crosses the initial security boundary into other components. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA's SSVC assessment records no known exploitation, but a vendor patch is available.
Tampering via command injection affects Microsoft Outlook for iOS versions 1.0.0 through 5.2617.0, where a network-based attacker can craft content that, once the victim interacts with it, injects and executes unauthorized commands to alter data integrity. The vulnerability carries CVSS 7.4 (integrity-only impact, scope changed) and requires user interaction; there is no public exploit identified at time of analysis, and EPSS is very low at 0.04%. Note a source conflict: the CVE description names 'M365 Copilot' while the CPE and EUVD affected-version data point specifically to Outlook for iOS.
Remote code execution in Microsoft Dynamics 365 (on-premises) version 9.1 (and 9.0 builds prior to 9.1.44.15) allows an authenticated, high-privileged attacker to run arbitrary code over the network because the application executes with unnecessary privileges (CWE-250). Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.07%) and CISA SSVC records no known exploitation, so this is a high-CVSS but not currently exploited issue. The scope-changed CVSS 9.1 reflects that successful code execution can impact resources beyond the vulnerable component's original security authority.
Spoofing in Microsoft Office (Office LTSC for Mac 2021/2024 and Excel/Word for Android) lets an attacker with local access bypass access-control checks (CWE-284) to misrepresent content or its origin to a user. Microsoft has issued a patch; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 13th percentile), so this is a low-likelihood but high-technical-impact issue.
Privilege escalation in Microsoft Azure Logic Apps allows an authenticated attacker with low-level privileges to elevate their permissions over the network via improper access control (CWE-284). The CVSS 9.9 score is driven by a scope change (S:C), meaning a successful attack breaches the security boundary of the vulnerable component and impacts other resources with full confidentiality, integrity, and availability compromise. No public exploit identified at time of analysis, and EPSS probability is low (0.06%), consistent with CISA SSVC rating exploitation as 'none'.
Privilege elevation in Microsoft Visual Studio Code (all releases from 1.0.0 up to but not including 1.119.1) stems from a session fixation weakness (CWE-384) that a remote, unauthenticated attacker can leverage to hijack a victim's authenticated session after the victim is lured into interacting with an attacker-supplied session identifier. The flaw carries a CVSS 8.8 rating with total confidentiality, integrity, and availability impact, but currently has no public exploit identified at time of analysis and a low EPSS score of 0.06% (18th percentile). Microsoft self-reported the issue and has shipped a fix, while CISA's SSVC framework records exploitation as 'none' and non-automatable.
Authentication bypass in Microsoft's SAML SSO plugins for Atlassian Jira (versions 1.0.0 through 1.3.2) and Confluence (versions 1.0.0 through 7.3.x) allows a remote, unauthenticated attacker to impersonate other users and elevate privileges over the network due to an incorrectly implemented authentication algorithm. Rated CVSS 9.1 with full confidentiality and integrity impact, the flaw is deemed automatable with total technical impact by CISA's SSVC framework, though EPSS remains low (0.12%) and no public exploit has been identified at time of analysis. A vendor patch is available.
Local privilege escalation in Microsoft's Azure Connected Machine Agent (versions 1.0.0 through 1.62) allows a low-privileged authenticated user on an Azure Arc-enabled machine to gain SYSTEM-level privileges by abusing an improper access control weakness. Microsoft has released a fixed build (1.63) and this is currently classified with no known exploitation (SSVC: none), consistent with an EPSS score of just 0.04%; no public exploit identified at time of analysis. The flaw is tagged as an authentication bypass and carries full technical impact (total) across confidentiality, integrity, and availability.
Privilege escalation in Windows Admin Center in Azure Portal (versions 1.0 up to but not including 2.6.7) lets an already-authenticated, low-privileged network user gain higher privileges by abusing improper access control (CWE-284). Microsoft reports a patch is available; there is no public exploit identified at time of analysis and EPSS probability is low (0.06%). Tagged as an authentication-bypass class issue, successful exploitation yields total control (high confidentiality, integrity, and availability impact) over the affected management surface.
Local privilege escalation in Microsoft Office Click-To-Run (Microsoft 365 Apps, Office 2019, Office LTSC 2021/2024) allows an authenticated local attacker to elevate privileges due to improper access control in the update/servicing component. A successful attack results in total compromise of confidentiality, integrity, and availability with a scope change beyond the vulnerable component. There is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%, 12th percentile), but the vendor rates technical impact as total.
Local privilege escalation in Microsoft Office Click-To-Run (the servicing/update engine behind Microsoft 365 Apps, Office 2019, and Office LTSC 2021/2024) lets an already-authenticated low-privileged user escalate to higher privileges on the host due to insufficiently granular access control (CWE-1220). The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H) shows a scope change with total confidentiality, integrity, and availability impact, meaning a successful attacker crosses a security boundary from the Office servicing context to the wider system. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none', so this is a serious-but-not-actively-exploited local EoP that should be patched on the normal accelerated cycle.
Local privilege elevation in Microsoft Office Click-To-Run (affecting Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024) lets an already-authenticated local attacker exploit a use-after-free memory corruption to gain higher privileges on the host. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS probability is negligible (0.04%) and CISA SSVC records exploitation status as none, indicating this is a patch-on-schedule issue rather than an emergency.
Remote denial of service in the Windows TCP/IP stack lets an unauthorized adjacent-network attacker crash affected systems by triggering a NULL pointer dereference (CWE-476) via crafted network traffic. Reported by Microsoft and patched across the Windows 10, Windows 11, and Windows Server 2012-2025 families, the flaw requires no authentication or user interaction but is limited to attackers on the same logical network segment. EPSS is low (0.14%, 34th percentile) and CISA SSVC lists exploitation as none, so this is a real-but-not-urgent patch item with no public exploit identified at time of analysis.
Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-privileged user to execute arbitrary code in the kernel context via a heap-based buffer overflow. All currently supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) are affected. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.02%), but the total technical impact and low exploitation barrier make it a meaningful patch-priority for endpoint hardening.
Local privilege escalation in Microsoft Windows Hyper-V (Windows 11 22H3/23H2 and Windows Server 2022) stems from a use-after-free memory corruption flaw that lets an attacker executing code in a guest context elevate privileges with a scope-changing impact on the host. Microsoft has released fixed builds and rates this critical (CVSS 9.3, total technical impact per CISA SSVC), but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). The scope change (S:C) combined with the Hyper-V attack surface is consistent with a guest-to-host virtualization boundary escape.
Local denial of service in Microsoft Windows TCP/IP networking stack allows an unauthorized local attacker to trigger a null pointer dereference (CWE-476), crashing the system or causing broad service disruption. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. Reported by Microsoft, this is a crash/availability issue only - no code execution or data exposure - with no public exploit identified at time of analysis and a very low (0.05%) EPSS exploitation probability.
Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authenticated low-privileged user to gain SYSTEM-level control across virtually all supported Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC rating exploitation as 'none'. The flaw is a serious defense-in-depth concern because it grants total confidentiality, integrity, and availability impact once a foothold exists, but it is not remotely reachable and requires prior local access.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user gain SYSTEM-level rights on affected Windows client and server builds by triggering an integer underflow (CWE-191) in the driver's log-file parsing. The flaw yields total confidentiality, integrity, and availability impact on the local machine. There is no public exploit identified at time of analysis, EPSS risk is low (0.06%, 19th percentile), and CISA SSVC records exploitation status as none - but CLFS is a historically heavily-targeted attack surface, so patching is warranted.
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated (typically SYSTEM-level) privileges across nearly all supported Windows client and server releases. Microsoft has released patches, and the flaw carries a total technical-impact rating (SSVC), though EPSS is very low (0.04%) and there is no public exploit identified at time of analysis. It is not on CISA KEV, indicating no confirmed active exploitation.
Local privilege escalation in the Windows Kernel affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where an untrusted pointer dereference (CWE-822) lets an already-authenticated local attacker execute code with SYSTEM-level privileges. Microsoft has released a patch, and no public exploit is identified at time of analysis; EPSS exploitation probability is very low (0.03%) and the flaw is not on CISA KEV. Despite the 'Information Disclosure' tag applied in vendor metadata, the CVSS vector and description describe a privilege-elevation primitive with total confidentiality, integrity, and availability impact on the affected host.
Remote code execution in Microsoft SQL Server (2016 SP3 through 2025) lets an authenticated attacker with low-privilege database access run arbitrary code on the server via external control of a file name or path (CWE-73). The CVSS 3.1 base score is 8.8 with high impact to confidentiality, integrity, and availability; publicly available exploit code exists, though the flaw is not on CISA KEV and EPSS remains very low (0.06%, 20th percentile), indicating minimal observed exploitation to date. Microsoft has released patched builds across all affected branches.
Local code execution in Microsoft Word (and Office 2016/2019, LTSC 2021/2024, 365 Apps, Office for Mac, and SharePoint Server) stems from an untrusted pointer dereference (CWE-822) that lets an attacker run arbitrary code with the victim's privileges when a malicious file is processed. Microsoft rates it CVSS 8.4 with total technical impact (high confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC marks exploitation as none and not automatable, indicating no observed real-world attacks yet.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-privilege access to execute arbitrary code across the network by abusing insufficiently granular access controls (CWE-1220). The flaw carries a CVSS 8.8 rating with full confidentiality, integrity, and availability impact; however EPSS estimates only a 0.06% exploitation probability and CISA SSVC records no observed exploitation, so this is currently no public exploit identified at time of analysis. Microsoft has released patches for all affected editions.
Arbitrary code execution in Microsoft Excel (and the broader Office family through Microsoft 365 Apps, Office 2019, LTSC 2021/2024, Office for Mac, and Office Online Server) is possible when a user opens a maliciously crafted spreadsheet that triggers a heap-based buffer overflow (CWE-122), running attacker code in the context of the current user. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.06%, 18th percentile), but the technical impact is total (full confidentiality, integrity, and availability loss). Microsoft has released patches; exploitation requires the victim to open a file, so it is a phishing/social-engineering-driven local vulnerability rather than a remotely wormable one.
Local code execution in Microsoft Office Word (2016, 2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory-corruption flaw that lets an attacker run arbitrary code in the context of the user who opens a maliciously crafted document. Microsoft has released a patch, and no public exploit has been identified at time of analysis; EPSS is very low at 0.06% (18th percentile) and CISA SSVC records no known exploitation.
Local code execution in Microsoft Office Excel (Excel 2016, Office 2019/LTSC 2021/2024, Microsoft 365 Apps, Office for Mac, and Office Online Server) arises from a use-after-free memory corruption flaw that an attacker triggers by convincing a user to open a specially crafted spreadsheet. Successful exploitation yields full compromise of the current user's context (high confidentiality, integrity, and availability impact). There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records exploitation status as none, indicating this is a patch-in-cycle issue rather than an active threat.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps, and Office LTSC for Mac 2021/2024) arises from a use-after-free memory corruption (CWE-416) that lets an attacker run arbitrary code with the victim's privileges. Microsoft's CVSS vector rates it AV:L/PR:N/UI:N (base 8.4) with total technical impact, though there is no public exploit identified at time of analysis and EPSS exploitation probability is negligible at 0.04%. A vendor patch is available from Microsoft (MSRC update guide).
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker to run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). An authorized user holding only low-level site privileges can escalate to full server compromise over the network with no user interaction. No public exploit identified at time of analysis, and CISA SSVC records exploitation status as 'none'; EPSS sits at 0.50% (66th percentile), indicating modest near-term exploitation probability despite the high CVSS 8.8 score.
Local privilege escalation in the Windows Link-Layer Discovery Protocol (LLDP) component affects a broad range of Windows client and server builds, where a CWE-415 double-free condition can be leveraged by an already-authenticated low-privileged user to gain higher privileges. The flaw was reported by Microsoft and is addressed in the July 2026 servicing updates; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is negligible (0.04%, 12th percentile), consistent with the high attack complexity (AC:H) and local-only vector.
Local privilege escalation in the Windows Projected File System (ProjFS) affects the full supported Windows line — Windows 10 (1809/21H2/22H2), Windows 11 (22H3 through 26H1), and Windows Server 2019/2022/2025 — where a use-after-free (CWE-416) lets an authenticated local user corrupt kernel/service memory and elevate to higher privileges. Microsoft-reported and patched, the flaw carries total technical impact per CISA SSVC but has no public exploit identified at time of analysis and a very low EPSS (0.04%). The high attack complexity (AV:L/AC:H) reflects a race-condition-style UAF that is non-trivial to win reliably.
Local privilege escalation in the Windows Telephony Service (TAPI) affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker can exploit a use-after-free (CWE-416) memory-corruption flaw to gain SYSTEM-level privileges; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 3.1 base score is 7.8 with total technical impact per CISA SSVC.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixes, but SSVC reports no observed exploitation and EPSS is very low (0.04%), so this is a patch-on-schedule kernel EoP rather than an emergency; no public exploit identified at time of analysis. Because Cloud Files underpins OneDrive/cloud sync placeholders, the driver is present on effectively every modern Windows install.
Local information disclosure in the Microsoft Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows 10, Windows 11 (through 26H1), and Windows Server (2016-2025) builds, where a buffer over-read (CWE-126) lets an already-authenticated local attacker read adjacent process memory. Microsoft's CVSS 7.8 vector rates full confidentiality, integrity, and availability impact even though the description characterizes the outcome as information disclosure, so the leaked memory could plausibly aid further local escalation. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and CISA SSVC marks exploitation as none, but a vendor patch is available.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an already-authenticated attacker to win a race condition and elevate to SYSTEM-level privileges across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). Exploitation requires local, low-privileged access rather than remote reach, and Microsoft rates the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), consistent with CISA SSVC marking exploitation as none and not automatable.
Remote code execution in Microsoft Windows Server 2025 kernel-mode drivers lets an authenticated attacker corrupt kernel memory via a use-after-free and run code with full system-level impact. Exploitation requires low-level privileges plus user interaction, and Microsoft has released a fix. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.06%).
Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) allows an authenticated low-privileged user to corrupt kernel/service memory through a double free (CWE-415) and elevate to SYSTEM. It affects a broad range of Windows client and server releases from Windows Server 2012/Windows 10 1607 through Windows 11 26H1 and Windows Server 2025 where the MSMQ feature is installed. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC records no known exploitation, though the technical impact is rated total.
Local privilege escalation in the Microsoft Windows TCP/IP stack (tcpip.sys) lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across virtually all supported Windows client and server releases. Microsoft assigns CVSS 7.8 and reports total technical impact, but SSVC exploitation status is 'none' and EPSS is only 0.06% (18th percentile), and there is no public exploit identified at time of analysis. Microsoft has released a patch via the Security Update Guide.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free memory-corruption condition. The flaw was reported by Microsoft and affects a broad range of Windows 10, Windows 11, and Windows Server builds; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.06%).
Spoofing in Microsoft Azure Machine Learning (versions 3.0.0 up to but not including 1.7.6) lets an unauthenticated network attacker inject improperly neutralized special elements into output rendered by a downstream component, enabling them to impersonate trusted content or identities against a victim who interacts with the malicious output. The CVSS 3.1 base score is 8.2 with a scope change and high confidentiality impact, but real-world urgency is tempered by an EPSS of just 0.05% (15th percentile) and CISA SSVC rating exploitation as 'none'. There is no public exploit identified at time of analysis and the issue is not on the CISA KEV list.
Remote code execution in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) allows an authenticated attacker (PR:L) to run arbitrary code over the network by submitting maliciously crafted serialized data that the server deserializes without validation. Microsoft has released a patch and no public exploit identified at time of analysis; EPSS is modest at 0.50% (66th percentile) and CISA SSVC rates exploitation as 'none' but technical impact as 'total'. The bug follows the well-known SharePoint deserialization RCE pattern (CWE-502), making it a high-value target for post-authentication lateral movement and full server compromise.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker to run arbitrary code across the network by submitting maliciously crafted serialized data (CWE-502). Any user holding low-privilege authenticated access to the SharePoint web application can achieve total compromise of the server (C:H/I:H/A:H). There is no public exploit identified at time of analysis, and the EPSS probability is modest at 0.50% (66th percentile), but the impact is total and a vendor patch is already available.
Remote denial of service in ASP.NET Core (.NET 8.0, 9.0, and 10.0) allows an unauthenticated attacker to send crafted network requests that trigger a loop with an unreachable exit condition (CWE-835), pinning CPU and rendering the application unresponsive. Publicly available exploit code exists, though there is no public exploit identified as being used in active attacks; EPSS is very low (0.04%, 12th percentile), consistent with the CISA SSVC 'Exploitation: none' assessment. Microsoft has released fixed runtime packages, and the flaw is availability-only with no confidentiality or integrity impact.
Remote code execution in Microsoft Dynamics 365 (on-premises) versions 9.0 and 9.1 (prior to 9.1.44.15) lets an authenticated attacker inject and execute arbitrary code across the network with a scope change beyond the vulnerable component. Rated CVSS 9.9, the flaw yields total confidentiality, integrity, and availability impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.07%, 21st percentile). Microsoft has released a fixed build (9.1.44.15).
Local privilege escalation in the Windows Desktop Window Manager (DWM) Core Library affects Windows 11 (24H2, 25H2, 26H1) and Windows Server 2025, where an integer overflow (CWE-190) lets an already-authenticated low-privileged user run code with SYSTEM-level rights. Microsoft has released a patch and reported the flaw itself; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.06%). SSVC rates exploitation as none but technical impact as total, marking it a classic patch-Tuesday local EoP rather than a mass-exploitation threat.
Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated, low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated privileges across virtually all supported Windows client and server builds. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is negligible (0.04%) and CISA's SSVC rates exploitation as none, indicating this is a defense-in-depth fix rather than an emergency. The flaw is high-value as a post-compromise escalation primitive but requires local code execution and winning a race condition to trigger.
Information disclosure in Microsoft Edge (Chromium-based) before 148.0.3967.55 allows a remote, unauthenticated attacker to read data they should not have access to by luring a victim into interacting with malicious web content. Rooted in external control of a file name or path (CWE-73) with a changed CVSS scope, it can leak sensitive information across security boundaries. Reported by Microsoft with a vendor patch available; no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.05%).
Local code execution in Microsoft Office (LTSC for Mac 2021/2024 and Office for Android) via a heap-based buffer overflow (CWE-122) that an unauthorized attacker triggers when a victim opens a maliciously crafted document, yielding full confidentiality, integrity, and availability impact in the user's context. Exploitation requires user interaction (UI:R) and local access (AV:L), so weaponization depends on social engineering rather than remote reachability. This is no public exploit identified at time of analysis, with a very low EPSS score of 0.06% and CISA SSVC rating exploitation as 'none', indicating no observed activity despite the 'total' technical impact.
Remote code execution in the Windows Native WiFi Miniport Driver allows an unauthorized attacker on an adjacent network to win a timing race and run arbitrary code on affected Windows 10, Windows 11, and Windows Server systems. The flaw stems from improper synchronization of a shared resource in the kernel-mode wireless driver and carries a total (C:H/I:H/A:H) technical impact. No public exploit has been identified and EPSS is very low (0.07%), but successful exploitation grants full kernel-level compromise without authentication.
Local code execution in Microsoft Visual Studio Code before 1.119.1 stems from improper neutralization of script-related HTML tags (basic XSS, CWE-80) rendered within the editor's webview surfaces, letting an attacker who tricks a user into opening crafted content run code in the victim's context. Exploitation requires user interaction (opening a malicious file/workspace) and is reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and EPSS is negligible at 0.05% (16th percentile).
Security-feature bypass in GitHub Copilot and Visual Studio (affecting Visual Studio Code builds before 1.119.1) lets a remote, unauthenticated attacker inject unneutralized special elements into a downstream component (CWE-74) to defeat a built-in protection, provided a developer is lured into a triggering action (UI:R). With CVSS 8.8 and full confidentiality/integrity/availability impact, successful exploitation could subvert Copilot/editor security controls; however there is no public exploit identified at time of analysis, EPSS is low (0.06%), and CISA SSVC records exploitation status as none.
Spoofing in Microsoft PowerPoint for Android (versions 16.0.0.0 through 16.0.19822.20189) lets an authorized local attacker misrepresent content or identity by abusing improper access control (CWE-284). The flaw requires low-privilege local access and no user interaction per the CVSS vector, and there is no public exploit identified at time of analysis; EPSS is very low at 0.04% (12th percentile) and CISA SSVC scores exploitation as 'none', indicating no observed activity despite a 'total' technical-impact rating. Microsoft has released a fixed build.
Spoofing in Microsoft Word for Android (versions 16.0.0.0 up to but excluding 16.0.19822.20190) stems from an improper access control weakness (CWE-284) that an already-authorized local attacker can abuse to misrepresent content or identity. The CVSS 3.1 vector (AV:L/PR:L) confirms a local, low-privileged authenticated attacker is required, and SSVC rates technical impact as total despite no listed availability impact. There is no public exploit identified at time of analysis, EPSS is a very low 0.04% (12th percentile), and it is not on the CISA KEV list.
Remote code execution in Microsoft Windows DNS lets an unauthenticated attacker corrupt heap memory over the network and run arbitrary code on affected Windows 11 (22H3 through 26H1) and Windows Server 2022/2025 systems. The flaw is a CWE-122 heap-based buffer overflow rated CVSS 9.8, reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), so this is a high-severity but not-yet-exploited issue. CISA SSVC flags it as automatable with total technical impact, meaning successful exploitation fully compromises the host.
Local privilege escalation in the Windows Server Data Deduplication feature (dedup.sys / associated services) lets an authenticated low-privileged user corrupt kernel memory to gain SYSTEM-level rights. Reported by Microsoft across Windows Server 2012 R2 through 2025, it carries a CVSS 7.8 and total technical impact per CISA SSVC, but has no public exploit identified at time of analysis and a very low EPSS of 0.04% (13th percentile). It is not listed in CISA KEV and shows no evidence of active exploitation.
Remote code execution in Microsoft Data Formulator versions prior to 0.7 lets an unauthorized attacker run arbitrary code by inducing a user to interact with malicious content (CWE-94 code injection). The flaw is network-reachable and requires no authentication, but does require user interaction (CVSS 3.1 8.8, AV:N/UI:R). A vendor patch is available; there is no public exploit identified at time of analysis and EPSS probability is very low (0.06%).
Remote code execution in the Windows Netlogon service (across Windows Server 2012 through 2025) allows an unauthenticated attacker to run arbitrary code over the network by triggering a stack-based buffer overflow (CWE-121). With a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N and total technical impact, this is a critical, pre-authentication server-side flaw. Microsoft has released patches; publicly available exploit code exists, though EPSS remains low (0.09%) and there is no confirmed active exploitation at time of analysis.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticated low-privileged user to elevate to SYSTEM across Windows 10, Windows 11 (21H2 through 26H1), and Windows Server 2022/2025. The flaw stems from external control of a file name or path (CWE-73) inside the kernel-mode WinSock support driver, yielding total confidentiality, integrity, and availability impact per CVSS 7.8. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC records exploitation as none, but the total technical impact and near-universal Windows footprint make it a standard Patch Tuesday priority.
Local privilege elevation in Microsoft Office (Microsoft 365 Apps for Enterprise, Office 2019, and Office LTSC 2021/2024) stems from a use-after-free memory corruption flaw (CWE-416) that an already-authorized local attacker can trigger to gain higher privileges on the host. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is very low (0.04%, 13th percentile) and CISA SSVC records exploitation as none, indicating no observed in-the-wild activity. The CVSS 3.1 base score is 7.8 with total technical impact (C:H/I:H/A:H) once triggered.
Local privilege escalation in Microsoft Dynamics 365 Business Central (2024 Release Wave 2 through 2026 Release Wave 1) lets an already-authenticated, low-privileged user elevate to higher privileges on the host through a weak authentication mechanism (CWE-1390). Successful exploitation yields total compromise of confidentiality, integrity, and availability of the affected instance. There is no public exploit identified at time of analysis, and CISA SSVC rates exploitation as 'none' with an EPSS of just 0.04% (12th percentile), indicating low near-term exploitation likelihood.
Remote code execution in the Microsoft Windows TCP/IP stack allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on a wide range of Windows 10, Windows 11, and Windows Server builds. The flaw carries CVSS 8.1 but requires winning a memory-corruption race (AC:H), and there is no public exploit identified at time of analysis; EPSS is very low at 0.09% and CISA SSVC lists exploitation as none. A vendor patch is available from Microsoft.
Denial of service in the Microsoft Windows TCP/IP networking stack allows an unauthenticated, adjacent-network attacker to crash the host by triggering a null pointer dereference (CWE-476) during packet processing, with no user interaction required. The flaw affects essentially the entire supported Windows client and server lineup, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, and the low EPSS score (0.14%) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation despite the broad footprint.
Local privilege escalation in the Microsoft Windows SMB Client (mrxsmb/rdbss) driver lets a low-privileged, authenticated user corrupt kernel memory through a use-after-free (CWE-416) and elevate to SYSTEM. The flaw affects a broad range of Windows client and server builds from Windows Server 2012 R2 through Windows 11 25H2/26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none' - but technical impact is 'total', so it remains a meaningful patch-Tuesday-class local EoP.
Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an already-authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025 are affected, but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). Microsoft has released patches and CISA's SSVC framework rates exploitation as 'none' with total technical impact.
Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Server 2012 through Server 2025). Exploitation is CVSS 7.8 with total technical impact per CISA SSVC, but SSVC records no observed exploitation and EPSS is very low (0.04%), and no public exploit was identified at time of analysis. A vendor patch is available from Microsoft (MSRC).
Information disclosure in the Windows TCP/IP networking stack allows a remote, unauthenticated attacker to read sensitive memory contents over the network by triggering a use-after-free condition. All supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025) are affected. Microsoft-reported with no public exploit identified at time of analysis; EPSS is low (0.06%, 19th percentile) and CISA SSVC records exploitation status as none.
Denial of service in the Microsoft Windows TCP/IP stack (Windows 11 24H2/25H2/26H1 and Windows Server 2025) allows a remote, unauthenticated attacker to crash the affected system by triggering a null pointer dereference over the network. No public exploit has been identified at time of analysis and the EPSS probability is low (0.14%, 34th percentile), but the flaw is network-reachable with no privileges or user interaction and CISA SSVC rates it automatable. Impact is limited to availability - no code execution or data disclosure.
Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an authorized (low-privileged) attacker to run code with SYSTEM-level rights by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases and carries a CVSS 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, EPSS is very low (0.06%, 19th percentile), and it is not listed in CISA KEV, indicating no observed exploitation to date.
Local privilege escalation in Windows Cryptographic Services lets an authenticated low-privileged user corrupt heap memory (CWE-122) to gain SYSTEM-level control across supported Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total, and Microsoft has released patches. Because it requires prior local access, it is a post-compromise escalation primitive rather than an initial-access threat.
Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) allows an authenticated attacker with low-level site privileges to run arbitrary code across the network by submitting maliciously crafted serialized data (CWE-502). Microsoft has released a patch; there is no public exploit identified at time of analysis, and the EPSS score is low (0.31%, 55th percentile), with CISA's SSVC framework rating exploitation status as 'none' but technical impact as 'total'. The combination of authenticated-but-low privilege access and full compromise of confidentiality, integrity, and availability makes this a meaningful escalation-to-RCE risk in enterprise collaboration environments.
Local code execution in Microsoft Word (and the Office suites that bundle it - Office 2016/2019, LTSC 2021/2024, Microsoft 365 Apps, and Office LTSC for Mac 2021/2024) stems from a use-after-free memory-corruption defect that lets an attacker run arbitrary code in the context of the current user, typically by having the victim process a crafted document. Microsoft (the reporting party) has released a fix; there is no public exploit identified at time of analysis and EPSS is very low (0.04%, 14th percentile). SSVC rates exploitation as none but technical impact as total, so this is a patch-on-schedule item rather than an emergency.
Local code execution in Microsoft Word (Office 2016 through Office LTSC 2024, Microsoft 365 Apps, and Office for Mac) results from a type-confusion flaw (CWE-843) that lets an unauthorized attacker run arbitrary code with the victim's privileges. Microsoft rates it CVSS 8.4 with total technical impact, but there is no public exploit identified at time of analysis and EPSS exploitation probability is low (0.15%, 35th percentile). CISA SSVC records exploitation status as none and the issue is not automatable, indicating no observed in-the-wild activity.
Local code execution in Microsoft Office (2016, 2019, LTSC 2021/2024, 365 Apps for Enterprise, Office for Android, and Office LTSC for Mac 2021/2024) stems from a heap-based buffer overflow that lets an attacker run arbitrary code with the victim's privileges. The flaw was reported by Microsoft, a vendor patch is available, and there is no public exploit identified at time of analysis; EPSS is very low at 0.04% and CISA SSVC records exploitation as none. Impact is total (full confidentiality, integrity, and availability loss) but exploitation is not automatable and, per typical Office file-parsing bugs, hinges on processing attacker-supplied content.
Information disclosure in Microsoft Excel (and the broader Office family - Office 2019, Office LTSC 2021/2024, Office for Mac, Microsoft 365 Apps for Enterprise, and Office Online Server) allows an attacker to read memory beyond an allocated buffer when a victim opens a crafted spreadsheet, potentially leaking sensitive in-process data. Exploitation is local and requires user interaction (opening the malicious file); there is no public exploit identified at time of analysis and CISA SSVC scores exploitation as 'none'. EPSS is very low (0.06%, 18th percentile), indicating negligible observed exploitation activity, though the technical impact is rated 'total'.
Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) allows an authenticated attacker to run arbitrary code over the network by supplying maliciously crafted serialized data (CWE-502). Any user holding valid low-privilege credentials on the SharePoint farm can achieve total compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and CISA SSVC records exploitation status as none; EPSS is a modest 0.50% (66th percentile).
Privilege escalation in Microsoft Windows Admin Center (versions 1809.0 before 2.6.5.16) allows an already-authenticated, low-privileged network user to gain higher privileges by exploiting a missing authorization check (CWE-862). Successful exploitation yields high integrity and availability impact with limited confidentiality disclosure. There is no public exploit identified at time of analysis, and EPSS is very low (0.05%, 16th percentile), but the CVSS base score of 8.3 and 'total' SSVC technical impact make it a meaningful risk in environments where WAC is exposed.
Local privilege elevation in Microsoft .NET (Windows Desktop/WPF runtime) for versions 8.0, 9.0, and 10.0 allows an attacker to run code at a higher privilege level after a targeted user opens crafted input. The root cause combines improper input validation (CWE-20) with a heap-based buffer overflow (CWE-122), yielding total technical impact per CISA SSVC. Publicly available exploit code exists, but the vulnerability is not in CISA KEV and EPSS is low (0.11%, 30th percentile), indicating no observed widespread exploitation to date.
Denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows remote unauthenticated attackers to exhaust host memory across all supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The flaw is a memory leak (CWE-401) triggered over the network with no privileges or user interaction, but impact is limited to availability with no data exposure. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.08%, 23rd percentile).
Local code execution in the Windows Graphics Device Interface (GDI) component affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. An attacker who convinces a user to open a maliciously crafted file or content triggers a heap-based buffer overflow (CWE-122) in GDI, running arbitrary code in the victim's context with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records no known exploitation, so this is a patch-on-cycle item rather than an emergency.
Local privilege escalation in the Windows Kernel affects a broad range of Windows Server releases (2012 through 2025, including Server Core installations), where a heap-based buffer overflow (CWE-122) lets an already-authenticated local user corrupt kernel heap memory to gain SYSTEM-level privileges. Microsoft has released patches and rates it CVSS 7.8; there is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as none but technical impact as total. EPSS is very low (0.04%, 13th percentile), consistent with the local-only attack vector that requires prior code execution on the host.
Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an already-authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across supported Windows 10, Windows 11 (through 26H1) and Windows Server 2019-2025 builds. Microsoft has released fixes; there is no public exploit identified at time of analysis, EPSS risk is very low (0.04%), and it is not listed in CISA KEV. Despite 'Denial Of Service' tagging, the CVSS vector rates full confidentiality, integrity and availability impact, consistent with a kernel EoP.
Local privilege escalation in the Windows Win32K kernel-mode subsystem (ICOMP component) lets an already-authenticated low-privileged attacker gain SYSTEM-level control across a broad range of supported Windows client and server builds. The flaw is a type-confusion (CWE-843) memory-corruption issue reported by Microsoft; there is no public exploit identified at time of analysis and the EPSS probability is low (0.11%), but SSVC rates the technical impact as total. This is a standard Patch-Tuesday-class kernel EoP whose value is as the second stage of an intrusion after an attacker already has a foothold.
Local privilege escalation in the Windows Ancillary Function Driver for WinSock (AFD.sys) allows low-privileged authenticated users to execute arbitrary code with SYSTEM privileges via use-after-free memory corruption. Microsoft has released patches addressing Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2012. CVSS base score is 7.0 (High) with local attack vector and high attack complexity. EPSS data not available; no CISA KEV listing at time of analysis, suggesting exploitation has not been observed in the wild despite public disclosure.
Local privilege escalation in Windows Storage Spaces Controller enables authenticated users with low-level access to gain SYSTEM-level privileges by exploiting an integer overflow that leads to memory corruption. Affects Windows 10 (1607 through 22H2), Windows 11 (all versions through 26H1), and Windows Server 2012 R2. Microsoft has released security updates through their March 2026 Patch Tuesday. No active exploitation confirmed in CISA KEV at time of analysis, though the combination of low attack complexity (AC:L) and no user interaction requirement (UI:N) makes post-compromise exploitation straightforward for attackers who have already obtained initial access.
Local privilege escalation in Windows TCP/IP stack affects Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server 2012 through a race condition vulnerability. Low-complexity exploitation requires only low-privilege authenticated access with no user interaction (CVSS 7.8, AV:L/AC:L/PR:L/UI:N). Vendor-released patch available from Microsoft Security Response Center. No public exploit code or active exploitation confirmed at time of analysis, though the low attack complexity and local vector suggest feasibility for post-compromise privilege escalation in enterprise environments.
Local privilege escalation in Windows Win32K graphics subsystem (Win32K - GRFX) allows authenticated users with low privileges to achieve SYSTEM-level access through a use-after-free memory corruption vulnerability. Affects multiple Windows 10, Windows 11, and Windows Server 2012 versions. Microsoft has released patches through their March 2026 security updates. The CVSS 7.0 (High) rating reflects high attack complexity (AC:H), requiring specific race condition timing or system state manipulation, though EPSS data is not yet available for this recently disclosed CVE.
Race condition in Windows Ancillary Function Driver for WinSock (AFD.sys) enables local privilege escalation for low-privileged authenticated users across Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server 2016. Microsoft confirmed the vulnerability and released patches via their March 2026 security updates. The flaw requires high attack complexity (CVSS AC:H), suggesting exploitation depends on winning a narrow timing window in concurrent socket operations. EPSS data unavailable, no CISA KEV listing at time of analysis, but Microsoft's rapid patch indicates credible exploit risk.
Type confusion vulnerability in Windows Ancillary Function Driver for WinSock enables local authenticated users to escalate privileges to SYSTEM level on Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012. Microsoft has released patches through their March 2026 security update cycle. The vulnerability requires low-privilege local access but no user interaction, making it a high-value target for post-compromise lateral movement and persistence. CVSS 7.8 reflects complete system compromise potential, though EPSS data and KEV status are not available for this future-dated CVE.
Local privilege escalation in Windows Application Identity (AppID) Subsystem allows low-privileged authenticated users to execute code as SYSTEM via heap buffer overflow. Microsoft has released security patches across Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-26H1), and Windows Server 2012. CVSS 7.8 score reflects high impact to confidentiality, integrity, and availability. EPSS data not available; no confirmed active exploitation or public POC identified at time of analysis. Requires existing local access with standard user privileges, limiting remote attack surface.
Local privilege escalation in Windows Print Spooler Components affects Windows 10, Windows 11, and Windows Server 2012 through race condition exploitation. Authenticated low-privileged attackers can elevate to SYSTEM privileges via concurrent resource access attacks, though attack complexity is rated high (AC:H). Vendor-released patch available from Microsoft Security Response Center. No active exploitation confirmed in CISA KEV at time of analysis, but Print Spooler remains a historically attractive target with established attack patterns (PrintNightmare, SpoolFool precedents).
Local privilege escalation in Windows Win32K graphics subsystem affects Windows 10 (1607 through 22H2), Windows 11 (all versions including 26H1 preview), and Windows Server 2012 through authenticated low-privileged local users exploiting a use-after-free memory corruption flaw. Microsoft has released security updates addressing this CWE-416 vulnerability with CVSS 7.8 severity. The local attack vector and low complexity (AC:L) indicate straightforward exploitation once local access is achieved, though no public exploit code or active exploitation (CISA KEV) has been identified at time of analysis.