Skip to main content

Patch advisories

Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.

RSS Export CSV Brief (PDF) Slides (PPTX)
Microsoft release 1,590 Other vendors (KEV) 1,365 Linux 1,031 Vendor bulletins 84 Lifecycle 190

Patch these first

Top 10 of 11: exploited, disclosed before a patch, or “Exploitation More Likely” and network-reachable
  1. 1CVE-2026-96951Microsoft — Windows Shell Security Feature Bypass VulnerabilityActively exploited
  2. 2CVE-2026-108398Microsoft — .NET Framework Security Feature Bypass VulnerabilityPublicly disclosed before patch
  3. 3CVE-2026-92707Microsoft — MessagePack-CSharp Denial of Service VulnerabilityPublicly disclosed before patch
  4. 4CVE-2026-100214Microsoft — Microsoft Dynamics 365 Business Central Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
  5. 5CVE-2026-102217Microsoft — WebDAV Elevation of Privilege VulnerabilityExploitation More Likely, network-reachable
  6. 6CVE-2026-88159Microsoft — Windows Background Intelligent Transfer Service (BITS) Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
  7. 7CVE-2026-70279Microsoft — Microsoft Exchange Server Spoofing VulnerabilityExploitation More Likely, network-reachable
  8. 8CVE-2026-96940Microsoft — Microsoft Exchange Server Elevation of Privilege VulnerabilityExploitation More Likely, network-reachable
  9. 9CVE-2026-70571Microsoft — Microsoft Exchange Server Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
  10. 10CVE-2026-70229Microsoft — Windows Active Directory Domain Services Remote Code Execution VulnerabilityExploitation More Likely, network-reachable

Microsoft CVEs

Microsoft Security Update Guide · 1,590 CVEs
Microsoft CVEs, rows 1126 to 1150
#CVE · titleEVRSCVSSEPSSSignal
1126 CVE-2026-97014Microsoft — Microsoft Office Excel Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1127 CVE-2026-97744Microsoft — Microsoft Office PowerPoint Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1128 CVE-2026-70055Microsoft — Windows Cryptographic Services Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1129 CVE-2026-70260Microsoft — Microsoft Trace Data Helper Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1130 CVE-2026-70261Microsoft — Microsoft Trace Data Helper Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1131 CVE-2026-83773Microsoft — Windows MIDI Service Module Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1132 CVE-2026-85812Microsoft — Windows Bind Filter Driver Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1133 CVE-2026-70199Microsoft — Windows Kernel Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1134 CVE-2026-70232Microsoft — Windows Kernel Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1135 CVE-2026-83893Microsoft — Windows Clipboard User Service Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1136 CVE-2026-108462Microsoft — Windows Kernel Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1137 CVE-2026-85793Microsoft — Windows Sysmain Service Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1138 CVE-2026-96944Microsoft — Windows Storage Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1139 CVE-2026-96948Microsoft — Windows Client Side Caching driver (csc.sys) Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.5% 10 5.5 0.5% —
1140 CVE-2026-62687Microsoft — Windows Backup Engine Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.4% 10 5.5 0.4% —
1141 CVE-2026-70084Microsoft — Windows Projected File System Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.4% 10 5.5 0.4% —
1142 CVE-2026-70264Microsoft — Microsoft Defender Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.4% 10 5.5 0.4% —
1143 CVE-2026-83933Microsoft — Windows Update Orchestrator Service Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.4% 10 5.5 0.4% —
1144 CVE-2026-85916Microsoft — Azure Active Directory Information Disclosure VulnerabilityCVSS 6.2 · EPSS 0.4% 10 6.2 0.4% —
1145 CVE-2026-83739Microsoft — Windows Bluetooth Service Remote Code Execution VulnerabilityCVSS 7.5 · EPSS 0.4% 10 7.5 0.4% —
1146 CVE-2026-69789Microsoft — Windows Reliable Multicast Transport Driver (RMCAST) Remote Code Execution VulnerabilityCVSS 7.5 · EPSS 0.4% 10 7.5 0.4% —
1147 CVE-2026-70135Microsoft — Windows Remote POS Driver Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.4% 10 5.5 0.4% —
1148 CVE-2026-70227Microsoft — Windows Device Association Service Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.4% 10 5.5 0.4% —
1149 CVE-2026-83571Microsoft — Windows Audio Service Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.4% 10 5.5 0.4% —
1150 CVE-2026-83686Microsoft — Microsoft Windows Search Component Information Disclosure VulnerabilityCVSS 5.5 · EPSS 0.4% 10 5.5 0.4% —
Showing 1,126–1,150 of 1,590

CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.

Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.