Microsoft is publishing 200 vulnerabilities on , , and may yet prove counterproductive, especially if it causes other researchers to back away from mutually beneficial engagements with MSRC. A few days later, , use advances in LLM capability to probe not just specific software, but also the standards on which software rests. Microsoft warns that exploitation leads to uncontrolled resource consumption over a network, and expects that exploitation is more likely. The advisory credits both a third-party research firm and OpenAI’s Codex.
Microsoft has not yet directly addressed another HTTP/2 vulnerability which . It is worth noting that the fix was included in PowerToys v0.99.1 on April 29, 2026, without any apparent mention in the moves beyond regular extended support and into the pay-to-play Extended Security Updates (ESU) phase after July 14, 2026. On that same date, SharePoint will also move past extended support, but since there’s no ESU available, the only remaining option for fully-supported self-hosted SharePoint after the middle of next month will be SharePoint Subscription Edition.
Summary charts
Vulnerabilities by Product Family
Apps vulnerabilities
CVE | Title | Exploitation status | Publicly disclosed? | CVSS v3 base score |
|---|---|---|---|---|
Microsoft PC Manager Security Feature Bypass Vulnerability | Exploitation Unlikely | No | 7.8 | |
Office for Android Spoofing Vulnerability | Exploitation Unlikely | No | 7.1 | |
Windows Graphics Component Remote Code Execution Vulnerability | Exploitation More Likely | No | 7.8 |
Azure vulnerabilities
CVE | Title | Exploitation status | Publicly disclosed? | CVSS v3 base score |
|---|---|---|---|---|
Azure Stack Edge Remote Code Execution Vulnerability | Exploitation Unlikely | No | 9.8 | |
.NET SDK Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
ASP.NET Core Denial of Service Vulnerability | Exploitation Less Likely | No | 7.5 | |
Microsoft Visual Studio Code CoPilot Chat Extension Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 8.4 | |
Visual Studio Code Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 9.6 | |
Visual Studio Code MSSQL Extension Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.8 | |
Visual Studio Code Tampering Vulnerability | Exploitation Less Likely | No | 6.5 |
ESU vulnerabilities
CVE | Title | Exploitation status | Publicly disclosed? | CVSS v3 base score |
|---|---|---|---|---|
DHCP Client Service Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | |
HTTP.sys Remote Code Execution Vulnerability | Exploitation More Likely | No | 9.8 | |
Microsoft DWM Core Library Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Microsoft Exchange Server Information Disclosure Vulnerability | Exploitation Unlikely | No | 5.0 | |
Microsoft Exchange Server Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.5 | |
Microsoft Exchange Server Spoofing Vulnerability | Exploitation Less Likely | No | 6.5 | |
Microsoft Graphics Component Elevation of Privilege Vulnerability | Exploitation More Likely | No | 7.8 | |
Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability | Exploitation Less Likely | No | 5.5 | |
NT OS Kernel Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Remote Desktop Client Remote Code Execution Vulnerability | Exploitation Unlikely | No | 8.8 | |
Remote Desktop Client Remote Code Execution Vulnerability | Exploitation Unlikely | No | 7.5 | |
Remote Desktop Client Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.5 | |
Remote Desktop Client Remote Code Execution Vulnerability | Exploitation More Likely | No | 8.8 | |
Secure Boot Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.9 | |
Secure Boot Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.9 | |
Secure Boot Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.9 | |
Secure Boot Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.9 | |
UEFI Secure Boot Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.0 | |
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.0 | |
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.0 | |
Windows Application Identity (AppID) Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Windows BitLocker Security Feature Bypass Vulnerability | Exploitation More Likely | No | 7.8 | |
Windows Bluetooth Port Driver Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.0 | |
Windows Boot Manager Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.9 | |
Windows Deployment Services (WDS) Remote Code Execution | Exploitation Less Likely | No | 8.1 | |
Windows DHCP Client Information Disclosure Vulnerability | Exploitation Unlikely | No | 5.5 | |
Windows DNS Client Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.0 | |
Windows DWM Core Library Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability | Exploitation Less Likely | No | 9.1 | |
Windows Graphics Component Remote Code Execution Vulnerability | Exploitation More Likely | No | 7.8 | |
Windows Hyper-V Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Windows Hyper-V Remote Code Execution Vulnerability | Exploitation Less Likely | No | 8.4 | |
Windows Kerberos Denial of Service Vulnerability | Exploitation Unlikely | No | 6.5 | |
Windows Kerberos Key Distribution Center (KDC) Remote Code Execution | Exploitation Unlikely | No | 7.1 | |
Windows Kernel Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.0 | |
Windows Mark of the Web Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 5.4 | |
Windows NTFS Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.8 | |
Windows Projected File System Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Push Notification Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Windows Push Notification Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Windows Push Notifications Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.8 | |
Windows Push Notifications Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.8 | |
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability | Exploitation Less Likely | No | 7.5 | |
Windows Shell Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Windows Storage Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.0 | |
Windows TCP/IP Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 9.6 | |
Windows Telephony Service Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.0 | |
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows UPnP Device Host Remote Code Execution Vulnerability | Exploitation Less Likely | No | 8.1 | |
LIBPNG: Chunk smuggling in push-mode APNG parser via unconsumed chunk body | n/a | No | 5.4 |
Microsoft Dynamics vulnerabilities
CVE | Title | Exploitation status | Publicly disclosed? | CVSS v3 base score |
|---|---|---|---|---|
Microsoft Excel Information Disclosure Vulnerability | Exploitation Unlikely | No | 8.2 | |
Microsoft Excel Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.8 | |
Microsoft Excel Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.0 | |
Microsoft Excel Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.8 | |
Microsoft Office Click-To-Run Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.0 | |
Microsoft Office Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Microsoft Office Project Server Spoofing Vulnerability | Exploitation Less Likely | No | 4.6 | |
Microsoft Office Remote Code Execution Vulnerability | Exploitation Less Likely | No | 8.4 | |
Microsoft Office Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.8 | |
Microsoft Office Remote Code Execution Vulnerability | Exploitation Less Likely | No | 8.4 | |
Microsoft Office Remote Code Execution Vulnerability | Exploitation Less Likely | No | 8.4 | |
Microsoft Outlook and Word Remote Code Execution Vulnerability | Exploitation Less Likely | No | 8.4 | |
Microsoft SharePoint Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 8.8 | |
Microsoft SharePoint Server Remote Code Execution Vulnerability | Exploitation Less Likely | No | 8.0 | |
Microsoft SharePoint Server Spoofing Vulnerability | Exploitation Less Likely | No | 4.6 | |
Microsoft SharePoint Server Spoofing Vulnerability | Exploitation Less Likely | No | 5.4 | |
Microsoft SharePoint Server Spoofing Vulnerability | Exploitation Less Likely | No | 4.6 | |
Microsoft SharePoint Server Spoofing Vulnerability | Exploitation Unlikely | No | 5.4 | |
Microsoft SharePoint Server Spoofing Vulnerability | Exploitation Less Likely | No | 5.4 | |
Microsoft SharePoint Server Spoofing Vulnerability | Exploitation Less Likely | No | 5.4 | |
Microsoft SharePoint Server Spoofing Vulnerability | Exploitation More Likely | No | 7.3 | |
Microsoft SharePoint Server Spoofing Vulnerability | Exploitation More Likely | No | 7.3 | |
Microsoft SharePoint Server Spoofing Vulnerability | Exploitation Less Likely | No | 4.6 | |
Microsoft Word Information Disclosure Vulnerability | Exploitation Unlikely | No | 3.3 | |
Microsoft Word Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.8 | |
Microsoft Word Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Graphics Component Remote Code Execution Vulnerability | Exploitation More Likely | No | 7.8 | |
USCiLab Cereal Shared Pointer type confusion | n/a | No | 7.3 | |
Rejected reason: This CVE ID was assigned as a duplicate of CVE-2026-50292 | n/a | No | 5.3 | |
DBI versions before 1.648 for Perl have a heap overflow when preparsing SQL statements with more than 9 binders | n/a | No | 8.6 | |
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: stack buffer overflow in font alias resolution due to libxfont2 name length mismatch | n/a | No | 7.8 | |
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in freecounter() | n/a | No | 6.6 | |
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free in misyncdestroyfence() | n/a | No | 6.6 | |
Xorg-x11-server: xorg-x11-server-xwayland: xorg-x11-server: use-after-free information disclosure in createsaverwindow() | n/a | No | 5.5 |
Other vulnerabilities
CVE | Title | Exploitation status | Publicly disclosed? | CVSS v3 base score |
|---|---|---|---|---|
Nuance PowerScribe Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 |
Server Software vulnerabilities
CVE | Title | Exploitation status | Publicly disclosed? | CVSS v3 base score |
|---|---|---|---|---|
Microsoft Exchange Server Information Disclosure Vulnerability | Exploitation Unlikely | No | 5.0 | |
Microsoft Exchange Server Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.5 | |
Microsoft Exchange Server Spoofing Vulnerability | Exploitation Less Likely | No | 6.5 | |
Microsoft Defender for Endpoint for Mac Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 5.5 |
Windows vulnerabilities
CVE | Title | Exploitation status | Publicly disclosed? | CVSS v3 base score |
|---|---|---|---|---|
DHCP Client Service Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | |
HTTP.sys Remote Code Execution Vulnerability | Exploitation More Likely | No | 9.8 | |
Microsoft Cryptographic Services Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 8.4 | |
Microsoft Graphics Component Elevation of Privilege Vulnerability | Exploitation More Likely | No | 7.8 | |
Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability | Exploitation Less Likely | No | 5.5 | |
NT OS Kernel Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Remote Desktop Client Remote Code Execution Vulnerability | Exploitation Unlikely | No | 8.8 | |
Remote Desktop Client Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.5 | |
Remote Desktop Client Remote Code Execution Vulnerability | Exploitation Unlikely | No | 7.5 | |
Remote Desktop Client Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.5 | |
Remote Desktop Client Remote Code Execution Vulnerability | Exploitation More Likely | No | 8.8 | |
Secure Boot Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.9 | |
Secure Boot Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.9 | |
Secure Boot Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.9 | |
Secure Boot Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.9 | |
UEFI Secure Boot Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Active Directory Domain Services Remote Code Execution Vulnerability | Exploitation Unlikely | No | 8.8 | |
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.0 | |
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.0 | |
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.0 | |
Windows BitLocker Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 5.3 | |
Windows BitLocker Security Feature Bypass Vulnerability | Exploitation More Likely | Yes | 6.8 | |
Windows Bluetooth Service Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Collaborative Translation Framework (CTFMON) Elevation of Privilege Vulnerability | Exploitation More Likely | Yes | 7.8 | |
Windows Deployment Services (WDS) Remote Code Execution | Exploitation Less Likely | No | 8.1 | |
Windows DHCP Client Information Disclosure Vulnerability | Exploitation Unlikely | No | 5.5 | |
Windows DNS Client Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.0 | |
Windows DWM Core Library Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows DWM Core Library Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows DWM Core Library Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows DWM Core Library Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows DWM Core Library Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Windows Function Discovery Service (fdwsd.dll) Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.0 | |
Windows Graphics Component Remote Code Execution Vulnerability | Exploitation More Likely | No | 7.8 | |
Windows Hyper-V Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Windows Hyper-V Remote Code Execution Vulnerability | Exploitation Less Likely | No | 8.4 | |
Windows Internet (wininet.dll) Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.8 | |
Windows Kerberos Denial of Service Vulnerability | Exploitation Less Likely | No | 5.3 | |
Windows Kernel Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Kernel Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.0 | |
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.8 | |
Windows Mark of the Web Security Feature Bypass Vulnerability | Exploitation Less Likely | No | 5.4 | |
Windows Narrator Braille Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows NTFS Remote Code Execution Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Performance Monitor Remote Code Execution Vulnerability | Exploitation Less Likely | No | 8.1 | |
Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.8 | |
Windows Projected File System Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows Push Notification Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Windows Push Notification Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Windows Push Notifications Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.8 | |
Windows Push Notifications Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.8 | |
Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability | Exploitation Less Likely | No | 7.5 | |
Windows Shell Information Disclosure Vulnerability | Exploitation Less Likely | No | 5.5 | |
Windows Storage Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 7.0 | |
Windows TCP/IP Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 9.6 | |
Windows Telephony Service Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.0 | |
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability | Exploitation Less Likely | No | 7.8 | |
Windows UPnP Device Host Remote Code Execution Vulnerability | Exploitation Less Likely | No | 8.1 | |
Winlogon Elevation of Privilege Vulnerability | Exploitation More Likely | No | 7.8 |
Zero-Day Vulnerabilities: Publicly Disclosed (No known exploitation)
CVE | Title | Exploitation status | Publicly disclosed? | CVSS v3 base score |
|---|---|---|---|---|
Windows BitLocker Security Feature Bypass Vulnerability | Exploitation More Likely | Yes | 6.8 | |
ARM: CVE-2025-10263 Completion of affected memory accesses might not be guaranteed by completion of a TLBI [kernel] | Exploitation Less Likely | No | 9.3 | |
DHCP Client Service Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | |
Nuance PowerScribe Remote Code Execution Vulnerability | Exploitation Less Likely | No | 9.8 | |
Windows Dynamic Host Configuration Protocol (DHCP) Tampering Vulnerability | Exploitation Less Likely | No | 9.1 | |
Windows TCP/IP Elevation of Privilege Vulnerability | Exploitation Unlikely | No | 9.6 |
SOCIAL SHARE CARD GENERATOR