Patch advisories
Microsoft's monthly release, other vendors' known-exploited CVEs, Linux distribution advisories, vendor bulletins and Microsoft lifecycle dates. CVEs use the same EVRS scale as the Priority Feed.
Patch these first
Top 10 of 11: exploited, disclosed before a patch, or “Exploitation More Likely” and network-reachable- 1CVE-2026-96951Microsoft — Windows Shell Security Feature Bypass VulnerabilityActively exploited
- 2CVE-2026-108398Microsoft — .NET Framework Security Feature Bypass VulnerabilityPublicly disclosed before patch
- 3CVE-2026-92707Microsoft — MessagePack-CSharp Denial of Service VulnerabilityPublicly disclosed before patch
- 4CVE-2026-100214Microsoft — Microsoft Dynamics 365 Business Central Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
- 5CVE-2026-102217Microsoft — WebDAV Elevation of Privilege VulnerabilityExploitation More Likely, network-reachable
- 6CVE-2026-88159Microsoft — Windows Background Intelligent Transfer Service (BITS) Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
- 7CVE-2026-70279Microsoft — Microsoft Exchange Server Spoofing VulnerabilityExploitation More Likely, network-reachable
- 8CVE-2026-96940Microsoft — Microsoft Exchange Server Elevation of Privilege VulnerabilityExploitation More Likely, network-reachable
- 9CVE-2026-70571Microsoft — Microsoft Exchange Server Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
- 10CVE-2026-70229Microsoft — Windows Active Directory Domain Services Remote Code Execution VulnerabilityExploitation More Likely, network-reachable
Microsoft CVEs
Microsoft Security Update Guide · 1,590 CVEs| # | CVE · title | EVRS | CVSS | EPSS | Signal |
|---|---|---|---|---|---|
| 1526 | CVE-2026-98224Microsoft — mm/vma: correctly unaccount on mmap_prepare() failure | 0 | — | 0.2% | — |
| 1527 | CVE-2026-98226Microsoft — mm, swap: fix SWAP_USAGE_OFFLIST_BIT collision with real usage count | 0 | — | 0.2% | — |
| 1528 | CVE-2026-98274Microsoft — net: psp: avoid conflicts with skb->decrypted and sk_validate_xmit_skb() | 0 | — | 0.2% | — |
| 1529 | CVE-2026-98446Microsoft — xfs: don't let hidden_space go negative in xfs_metafile_resv_init | 0 | — | 0.2% | — |
| 1530 | CVE-2026-98868Microsoft — dm-pcache: reject a kset that overruns its segment | 0 | — | 0.2% | — |
| 1531 | CVE-2026-98440Microsoft — KVM: arm64: nv: Delay freeing of shadow S2 structures until VM destruction | 0 | — | 0.2% | — |
| 1532 | CVE-2026-98445Microsoft — xfs: don't let memory failures leak blocks and kill repairs | 0 | — | 0.2% | — |
| 1533 | CVE-2026-98475Microsoft — s390/cmf: Fix virtual vs physical address confusion | 0 | — | 0.2% | — |
| 1534 | CVE-2026-98611Microsoft — bpf: Check params size before reading reserved fields | 0 | — | 0.2% | — |
| 1535 | CVE-2026-98615Microsoft — eth: fbnic: Set AW_FLUSH_MODE alongside AW_FLUSH when flushing the mailbox | 0 | — | 0.2% | — |
| 1536 | CVE-2026-98641Microsoft — bpf, arm64: set up the frame pointer for the exception callback | 0 | — | 0.2% | — |
| 1537 | CVE-2026-98680Microsoft — iio: accel: kionix-kx022a: Prevent memory leak and fix state | 0 | — | 0.2% | — |
| 1538 | CVE-2026-98702Microsoft — wifi: mac80211: reject invalid 320 MHz CSA bandwidth | 0 | — | 0.2% | — |
| 1539 | CVE-2026-98713Microsoft — KVM: arm64: Apply the fine-grained UNDEFs without FEAT_FGT | 0 | — | 0.2% | — |
| 1540 | CVE-2026-98728Microsoft — tpm: fix off-by-four bounds check in tpm2_get_random() | 0 | — | 0.2% | — |
| 1541 | CVE-2026-98730Microsoft — Bluetooth: btintel_pcie: reject oversized TX packets in send_frame() | 0 | — | 0.2% | — |
| 1542 | CVE-2026-98791Microsoft — net/mlx5e: Fix AF_XDP TX timestamp teardown NULL dereference | 0 | — | 0.2% | — |
| 1543 | CVE-2026-98841Microsoft — virt: vmgenid: set driver_data before registering notification handlers | 0 | — | 0.2% | — |
| 1544 | CVE-2026-98849Microsoft — pfcp: fix socket lifetime on netdevice registration failure | 0 | — | 0.2% | — |
| 1545 | CVE-2026-98244Microsoft — btrfs: clear free space tree creation state on rebuild failure | 0 | — | 0.2% | — |
| 1546 | CVE-2026-98259Microsoft — fs/dax: check zero or empty entry before converting xarray entry | 0 | — | 0.2% | — |
| 1547 | CVE-2026-98447Microsoft — xfs: fix wild memcpy access when formatting ondisk rtrefcount btree roots | 0 | — | 0.2% | — |
| 1548 | CVE-2026-98467Microsoft — KVM: arm64: nv: Fix null ptr deref on nested wp/unmap, teardown race | 0 | — | 0.2% | — |
| 1549 | CVE-2026-98472Microsoft — KVM: SEV: Free have_run_cpus during VM destruction even if VM is no longer SEV | 0 | — | 0.2% | — |
| 1550 | CVE-2026-98474Microsoft — s390/pci: Fix missing device lock in zpci_report_status() | 0 | — | 0.2% | — |
CISA KEV, FIRST EPSS, Microsoft Security Update Guide, endoflife.date, Debian, Red Hat, Ubuntu, Adobe, Apple, Chrome, Cisco, Ivanti and Oracle. Each row links to its own advisory.
Known-exploitation status, required actions, ransomware association and remediation deadlines come from the CISA Known Exploited Vulnerabilities Catalog. Exploitation probability and percentile are provided by FIRST.org's EPSS, used under FIRST's open data terms. Microsoft Patch Tuesday data is sourced from the Microsoft Security Update Guide; lifecycle milestones from endoflife.date.