Skip to main content

Patch advisories

Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.

RSS Export CSV Brief (PDF) Slides (PPTX)
Microsoft release 1,590 Other vendors (KEV) 1,364 Linux 1,031 Vendor bulletins 84 Lifecycle 190

Patch these first

Top 10 of 11: exploited, disclosed before a patch, or “Exploitation More Likely” and network-reachable
  1. 1CVE-2026-96951Microsoft — Windows Shell Security Feature Bypass VulnerabilityActively exploited
  2. 2CVE-2026-108398Microsoft — .NET Framework Security Feature Bypass VulnerabilityPublicly disclosed before patch
  3. 3CVE-2026-92707Microsoft — MessagePack-CSharp Denial of Service VulnerabilityPublicly disclosed before patch
  4. 4CVE-2026-100214Microsoft — Microsoft Dynamics 365 Business Central Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
  5. 5CVE-2026-102217Microsoft — WebDAV Elevation of Privilege VulnerabilityExploitation More Likely, network-reachable
  6. 6CVE-2026-88159Microsoft — Windows Background Intelligent Transfer Service (BITS) Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
  7. 7CVE-2026-70279Microsoft — Microsoft Exchange Server Spoofing VulnerabilityExploitation More Likely, network-reachable
  8. 8CVE-2026-96940Microsoft — Microsoft Exchange Server Elevation of Privilege VulnerabilityExploitation More Likely, network-reachable
  9. 9CVE-2026-70571Microsoft — Microsoft Exchange Server Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
  10. 10CVE-2026-70229Microsoft — Windows Active Directory Domain Services Remote Code Execution VulnerabilityExploitation More Likely, network-reachable

Microsoft CVEs

Microsoft Security Update Guide · 1,590 CVEs
Microsoft CVEs, rows 326 to 350
#CVE · titleEVRSCVSSEPSSSignal
326 CVE-2026-88116Microsoft — Windows Domain Name Service Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.5% 13 8.8 0.5% —
327 CVE-2026-88157Microsoft — Microsoft OpenSSH for Windows Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.5% 13 8.8 0.5% —
328 CVE-2026-88197Microsoft — Microsoft Office Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.5% 13 8.8 0.5% —
329 CVE-2026-96251Microsoft — Microsoft PowerShell Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.5% 13 8.8 0.5% —
330 CVE-2026-97751Microsoft — Microsoft Office Excel Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.5% 13 8.8 0.5% —
331 CVE-2026-85925Microsoft — Azure Key Vault Client SDK Elevation of Privilege VulnerabilityCVSS 8.2 · EPSS 0.5% 13 8.2 0.5% —
332 CVE-2026-108427Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.5% 13 8.8 0.5% —
333 CVE-2026-96957Microsoft — .NET Security Feature Bypass VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
334 CVE-2026-108428Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
335 CVE-2026-108429Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
336 CVE-2026-108430Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
337 CVE-2026-108431Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
338 CVE-2026-108432Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
339 CVE-2026-108426Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
340 CVE-2026-108437Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
341 CVE-2026-108439Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
342 CVE-2026-108440Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
343 CVE-2026-108441Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
344 CVE-2026-108442Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
345 CVE-2026-108443Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
346 CVE-2026-108444Microsoft — Microsoft Office Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
347 CVE-2026-108445Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
348 CVE-2026-108446Microsoft — Microsoft Office Excel Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
349 CVE-2026-108447Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
350 CVE-2026-108449Microsoft — Microsoft Office Word Remote Code Execution VulnerabilityCVSS 8.8 · EPSS 0.4% 13 8.8 0.4% —
Showing 326–350 of 1,590

CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.

Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.