2586
CVEs
210
Critical
1675
High
9
KEV
104
PoC
139
Unpatched C/H
93.2%
Patch Rate
0.5%
Avg EPSS
Severity Breakdown
CRITICAL
210
HIGH
1675
MEDIUM
662
LOW
33
Monthly CVE Trend
Affected Products (30)
Windows Server 2016
4942
Windows Server 2019
4718
Windows Server 2012
4033
Windows Server 2022
3196
Windows Server 2008
3091
Windows 10
2872
Windows 8 1
2102
Windows 7
2087
Windows 10 1809
2052
Windows 10 22h2
2018
Windows 10 21h2
2006
Windows Rt 8 1
1940
Windows 10 1607
1788
Windows Server 2025
1779
Windows 11 23h2
1638
Windows 11 22h2
1511
Windows 11 24h2
1334
Windows Server 2022 23h2
1311
Windows
1234
Windows 10 1507
1102
Internet Explorer
988
Windows 11 21H2
973
Flash Player
760
Office
748
Edge
725
Windows 11 25h2
643
365 Apps
614
Windows 11 26h1
509
Sharepoint Server
502
Windows 11
495
Top Risky CVEs
| CVE | Summary | Severity | CVSS | EPSS | Priority | Signals |
|---|---|---|---|---|---|---|
| CVE-2026-50522 | Remote code execution in Microsoft SharePoint Server (2016, 2019, and Subscription Edition) lets an unauthenticated attacker run arbitrary code by sending a crafted serialized payload over the network. The flaw is an untrusted-data deserialization (CWE-502) rated CVSS 9.8 with PR:N/UI:N, meaning no credentials or user interaction are required. No public exploit identified at time of analysis, but the pre-auth network vector and SharePoint's long history as an attacker target make this a high-priority patch. | CRITICAL | 9.8 | 19.7% | 159 |
KEV
PoC
|
| CVE-2026-58644 | Remote code execution in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) allows an unauthenticated network attacker to run arbitrary code on the server by submitting maliciously crafted serialized data (CWE-502). The CVSS 3.1 base score is 9.8 with a fully remote, no-interaction, no-privilege vector (AV:N/AC:L/PR:N/UI:N), placing it among the most severe SharePoint flaws. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but insecure-deserialization RCE in SharePoint has historically been a high-value target for rapid weaponization. | CRITICAL | 9.8 | 1.3% | 150 |
KEV
PoC
|
| CVE-2026-55040 | Security feature bypass in Microsoft SharePoint (Enterprise Server 2016, Server 2019, and Server Subscription Edition) lets a network-based, unauthenticated attacker defeat a weak-authentication protection mechanism (CWE-1390) to gain high-impact access to confidentiality and integrity. Rated CVSS 9.1 with no attacker privileges or user interaction required, this is a serious pre-authentication issue in a widely deployed collaboration platform. Microsoft has published a fix, and there is no public exploit identified at time of analysis. | CRITICAL | 9.1 | 0.7% | 146 |
KEV
PoC
|
| CVE-2026-56164 | Privilege elevation in Microsoft SharePoint Server (Enterprise Server 2016, Server 2019, and Subscription Edition) lets an unauthenticated network attacker reach a security-critical function that lacks any authentication check (CWE-306), gaining elevated privileges on the target farm. The flaw is confirmed actively exploited (CISA KEV) with publicly available exploit code, and its CVSS 3.1 base score of 9.8 (AV:N/AC:L/PR:N/UI:N) reflects fully remote, unauthenticated exploitation with high confidentiality, integrity, and availability impact. Microsoft has released a patch via MSRC. | CRITICAL | 9.8 | 7.0% | 142 |
KEV
PoC
|
| CVE-2026-69836 | Remote code execution in Microsoft Entra ID lets an unauthenticated network attacker run arbitrary code by submitting maliciously crafted serialized data that the service deserializes without validation (CWE-502). The CVSS 3.1 base score is a maximum 10.0 with a scope change, reflecting unauthenticated network reach and full compromise of confidentiality, integrity, and availability. There is no public exploit identified at time of analysis, and the issue is not listed in CISA KEV, but the combination of a cloud identity platform and PR:N/UI:N makes this an urgent-patch candidate. | CRITICAL | 10.0 | 1.4% | 126 |
KEV
PoC
|
| CVE-2026-81963 | Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privileges to elevate to SYSTEM on multiple Windows 11 and Windows Server 2025 builds. The vulnerability is confirmed actively exploited per CISA KEV, with full confidentiality, integrity, and availability impact following privilege escalation. Vendor-released patches are available for all identified affected builds and should be treated as an urgent patching priority. | HIGH | 7.8 | 0.6% | 115 |
KEV
PoC
|
| CVE-2026-85880 | Heap-based buffer overflow in the Windows Advanced Local Procedure Call (ALPC) subsystem enables a low-privileged local attacker to elevate privileges to SYSTEM level across a broad range of Windows 10 and Windows Server releases. The flaw (CWE-122) resides in ALPC's message-handling internals, where crafted IPC payloads can corrupt heap memory in a way that redirects execution. No public exploit has been identified at time of analysis, and Microsoft has released patches covering all affected builds. | HIGH | 7.8 | 0.6% | 115 |
KEV
PoC
|
| CVE-2026-56155 | Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-privileged user on the host gain higher privileges due to insufficient granularity of access control (CWE-1220). Affected deployments span AD FS on Windows Server 2012 through Windows Server 2025, and the flaw carries a CVSS 7.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, so this is a patch-priority-driven rather than exploitation-driven risk. | HIGH | 7.8 | 0.4% | 114 |
KEV
PoC
|
| CVE-2026-68820 | Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attacker to gain SYSTEM-level privileges through a use-after-free memory corruption flaw. Affected systems include Windows installations where the WinSock subsystem is active, which covers virtually all Windows deployments. No public exploit code or active exploitation has been identified at time of analysis, though the high-complexity exploitation bar somewhat limits immediate opportunistic risk. | HIGH | 7.0 | 0.4% | 110 |
KEV
PoC
|
| CVE-2026-52806 | Remote code execution in Gogs through 0.14.2 allows authenticated users (and unauthenticated attackers on default-configured instances with open registration) to execute arbitrary commands as the Gogs server process by crafting a pull request whose base branch name injects a `--exec` flag into the underlying `git rebase` invocation. A working Python proof-of-concept exists and has been validated end-to-end against Docker, Linux binary, and Windows installations, yielding shell access as the `git` user. No CISA KEV listing or EPSS data is provided, so this is treated as publicly available exploit code rather than confirmed active exploitation. | CRITICAL | 9.9 | 1.0% | 86 |
PoC
|
| CVE-2026-63520 | Remote code execution in Microsoft SharePoint is achievable by unauthenticated network attackers exploiting improper input validation (CWE-20), with the 'Authentication Bypass' tag indicating the flaw may circumvent access controls entirely. Three active SharePoint product lines are confirmed affected - Enterprise Server 2016, Server 2019, and the Subscription Edition - across a defined version range for each. Vendor patches are available from Microsoft; no public exploit code or CISA KEV listing has been identified at time of analysis, though the network-accessible, zero-privilege attack vector makes this a high-priority patching target. | HIGH | 8.1 | 1.1% | 82 |
PoC
|
| CVE-2026-62911 | Privilege escalation via capture-replay authentication bypass in Microsoft Exchange Server 2016, 2019, and Subscription Edition exposes organizations to full mailbox and administrative compromise. An already-authorized low-privilege network user can intercept and replay authentication tokens to impersonate higher-privileged accounts, achieving high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing exists at time of analysis, but Microsoft has released patches across all affected cumulative update tracks. | HIGH | 8.0 | 0.7% | 81 |
PoC
|
| CVE-2026-49798 | Local privilege escalation in the Microsoft Windows Kernel allows an unauthorized attacker to gain elevated (SYSTEM-level) privileges by triggering a use-after-free condition (CWE-416) in kernel memory. The flaw affects a broad range of supported Windows client and server releases, from Windows 10 1607 and Windows Server 2012 through Windows 11 26H1 and Windows Server 2025. Microsoft has released a patch; there is no public exploit identified at time of analysis and the issue is not listed in CISA KEV. | CRITICAL | 9.3 | 2.2% | 74 |
PoC
|
| CVE-2026-65667 | Privilege elevation in Microsoft Teams lets a remote, unauthenticated attacker gain unauthorized access across a network due to a missing authorization check (CWE-862). The maximum 10.0 CVSS rating stems from a changed scope with high confidentiality and integrity impact, meaning the flaw reaches resources beyond the initially vulnerable component. No public exploit identified at time of analysis and the issue is not listed in CISA KEV, but the perfect-score, no-precondition profile makes it a top-tier patch priority. | CRITICAL | 10.0 | 0.5% | 70 |
No patch
|
| CVE-2026-50515 | Remote code execution in Microsoft Azure Service Bus lets an already-authorized (PR:L) attacker send maliciously crafted serialized data that the service deserializes without validation (CWE-502), executing attacker-controlled code across the network. The scope-changed CVSS 9.9 rating reflects that code execution can break out of the caller's authorization boundary into the underlying managed-service host, threatening confidentiality, integrity, and availability of the messaging infrastructure. There is no public exploit identified at time of analysis, but the near-maximal severity and cloud-hosted, multi-tenant nature of the platform make this a high-priority issue. | CRITICAL | 9.9 | 0.9% | 70 |
No patch
|