Microsoft vulnerabilities under active exploitation

48 CVEs on this page carry evidence of exploitation.

Which Microsoft vulnerabilities are being exploited?

45 of them are in the CISA KEV catalog.

9 were added to KEV in the last 90 days.

• CVE-2026-20079 In KEV since 2026-09-09 · EPSS 88% · No fix identified here
• CVE-2026-87491 In KEV since 2026-09-09 · Fix identified
• CVE-2026-85880 In KEV since 2026-09-08 · Fix identified
• CVE-2026-85046 In KEV since 2026-09-04 · Fix identified
• CVE-2026-33824 In KEV since 2026-08-18 · EPSS 2% · No fix identified here
• CVE-2026-55040 In KEV since 2026-08-18 · Fix identified
• CVE-2026-65400 In KEV since 2026-08-18 · Fix identified
• CVE-2026-50522 In KEV since 2026-07-22 · Fix identified
• CVE-2026-56164 In KEV since 2026-07-14 · Fix identified
• CVE-2026-45659 In KEV since 2026-07-01 · EPSS 3% · Fix identified
• CVE-2026-45498 In KEV since 2026-05-20 · EPSS 1% · Fix identified
• CVE-2026-41091 In KEV since 2026-05-20 · EPSS <1% · Fix identified
• CVE-2026-33825 In KEV since 2026-04-22 · Fix identified
• CVE-2026-34197 In KEV since 2026-04-16 · EPSS 15% · Fix identified
• CVE-2009-0238 In KEV since 2026-04-14 · EPSS 43% · No fix identified here
• CVE-2026-32201 In KEV since 2026-04-14 · Fix identified
• CVE-2026-21643 In KEV since 2026-04-13 · EPSS 94% · No fix identified here
• CVE-2023-21529 In KEV since 2026-04-13 · EPSS 59% · No fix identified here
• CVE-2020-9715 In KEV since 2026-04-13 · EPSS 49% · No fix identified here
• CVE-2012-1854 In KEV since 2026-04-13 · EPSS 21% · No fix identified here
• CVE-2023-36424 In KEV since 2026-04-13 · EPSS 12% · No fix identified here
• CVE-2025-60710 In KEV since 2026-04-13 · EPSS 5% · No fix identified here
• CVE-2026-34621 In KEV since 2026-04-13 · EPSS 2% · No fix identified here
• CVE-2026-5281 In KEV since 2026-04-01 · EPSS 1% · Fix identified
• CVE-2026-20963 In KEV since 2026-03-18 · EPSS 30% · No fix identified here
• CVE-2026-20700 In KEV since 2026-02-12 · EPSS 1% · Fix identified
• CVE-2026-21510 In KEV since 2026-02-10 · EPSS 24% · Fix identified
• CVE-2026-21513 In KEV since 2026-02-10 · EPSS 16% · Fix identified
• CVE-2026-21525 In KEV since 2026-02-10 · EPSS 5% · Fix identified
• CVE-2026-21533 In KEV since 2026-02-10 · EPSS 4% · Fix identified
• CVE-2026-21519 In KEV since 2026-02-10 · EPSS 2% · Fix identified
• CVE-2026-21514 In KEV since 2026-02-10 · EPSS 2% · Fix identified
• CVE-2026-21509 In KEV since 2026-01-26 · EPSS 71% · No fix identified here
• CVE-2025-55182 In KEV since 2025-12-05 · EPSS 99.8% · Used in ransomware · Fix identified
• CVE-2025-61882 In KEV since 2025-10-06 · EPSS 99.7% · Used in ransomware · No fix identified here
• CVE-2025-53770 In KEV since 2025-07-20 · EPSS 100.0% · Used in ransomware · No fix identified here
• CVE-2025-4632 In KEV since 2025-05-22 · EPSS 24% · No fix identified here
• CVE-2025-3248 In KEV since 2025-05-05 · EPSS 100.0% · No fix identified here
• CVE-2025-31324 In KEV since 2025-04-29 · EPSS 99% · Used in ransomware · No fix identified here
• CVE-2025-24472 In KEV since 2025-03-18 · EPSS 7% · Used in ransomware · No fix identified here

Which of them have a fix?

We can name a fix for 22 of them.

For the rest we hold no patch identifier, which is not the same as no patch existing.

What PlainSec published about Microsoft

• CSuite Phishing Adds Endpoint Control to Mailbox Theft (2026-10-01)
• Talos Maps Antino to Microsoft 365 Control (2026-10-01)
• JadePuffer Used Azure Identities to Wipe Recovery Paths (2026-09-29)
• File Notifications Leak Activity Across User Accounts (2026-09-28)
• Proofpoint Finds TeamFiltration on Forgotten Microsoft 365 Accounts (2026-09-25)
• ClickFix Moves Malware Into Trusted Shells (2026-09-25)
• CLOSEDQUORUM Moves Malware Decisions Into LLMs (2026-09-24)
• ChainScript Hides C2 Behind Polygon Lookups (2026-09-22)
• NightEagle Reuses Credentials and GitHub Tooling (2026-09-21)
• Malicious Extensions Can Steer Chromium AI Assistants (2026-09-21)
• FamousSparrow Shifts to Modular Exchange Footholds (2026-09-18)
• Chosen Brick Shifts Infection to Personal Devices (2026-09-17)

Which Microsoft products this page tracks

• Active Directory
• Azure
• Azure Sentinel
• Exchange Online
• Exchange Server
• Intune
• Microsoft
• Microsoft 365
• Microsoft Active Directory
• Microsoft Azure
• Microsoft Copilot
• Microsoft Defender
• Microsoft Edge
• Microsoft Entra ID
• Microsoft Excel
• Microsoft Exchange
• Microsoft Exchange Online
• Microsoft Intune
• Microsoft Office
• Microsoft Power Platform
• Microsoft Sentinel
• Microsoft SharePoint
• Microsoft Teams
• Microsoft Windows
• Microsoft Windows 10
• Microsoft Windows 11
• Microsoft Windows Server
• Microsoft Word
• Office 365
• Power Automate
• SharePoint
• Teams
• Windows
• Windows Defender
• Windows Server

KEV and EPSS are re-checked daily. Page last updated 2026-09-30.