Patch Tuesday Archive
Patch Tuesday May 2026
Total CVEs
162
Critical
46
Important
109
Exploited
3
Publicly Disclosed
3
All CVEs this month 162
| CVE | Title | Severity | CVSS | Product | Exploited | Disclosed | Diffed |
|---|---|---|---|---|---|---|---|
| CVE-2026-40379 | Azure Entra ID Spoofing Vulnerability | Critical | 7.5 |
Azure Entra ID | - | - | - |
| CVE-2026-32207 | Azure Machine Learning Notebook Spoofing Vulnerability | Critical | 6.1 |
Azure Machine Learning | - | - | - |
| CVE-2026-33109 | Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability | Critical | 9.9 |
Azure Managed Instance for Apache Cassandra | - | - | - |
| CVE-2026-40412 | Azure Orbital Spatio Remote Code Execution Vulnerability | Critical | 9.8 |
Azure Orbital Spatio | - | - | - |
| CVE-2026-23652 | Microsoft Power Pages Remote Code Execution Vulnerability | Critical | 9.8 |
Microsoft Power Pages | - | - | - |
| CVE-2026-35430 | Azure Privileged Identity Management (PIM) Elevation of Privilege Vulnerability | Critical | 8.8 |
Azure Privileged Identity Management (PIM) | - | - | - |
| CVE-2026-40411 | Azure Virtual Network Gateway Remote Code Execution Vulnerability | Critical | 8.8 |
Azure Virtual Network Gateway | - | - | - |
| CVE-2026-47280 | Azure Resource Manager Elevation of Privilege Vulnerability | Critical | 9.8 |
Azure Resource Manager (ARM) | - | - | - |
| CVE-2026-42827 | M365 Copilot Information Disclosure Vulnerability | Critical | 7.5 |
M365 Copilot | - | - | - |
| CVE-2026-41090 | Microsoft Copilot Tampering Vulnerability | Critical | 9.3 |
Microsoft Copilot | - | - | - |
| CVE-2026-26147 | Azure Stack HCI Information Disclosure Vulnerability | Critical | 7.7 |
Azure Compute Gallery | - | - | - |
| CVE-2026-33843 | Microsoft Azure Active Directory B2C Elevation of Privilege Vulnerability | Critical | 9.8 |
Microsoft Azure Active Directory B2C | - | - | - |
| CVE-2026-32204 | Azure Monitor Agent Elevation of Privilege Vulnerability | Important | 7.8 |
Azure Monitor Agent | - | - | - |
| CVE-2026-33117 | Azure SDK for Java Security Feature Bypass Vulnerability | Important | 9.1 |
Azure SDK | - | - | - |
| CVE-2026-33834 | Windows Event Logging Service Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Event Logging Service | - | - | - |
| CVE-2026-33839 | Win32k Elevation of Privilege Vulnerability | Important | 7 |
Windows Win32K - GRFX | - | - | - |
| CVE-2026-34329 | Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability | Important | 8.8 |
Windows Message Queuing | - | - | - |
| CVE-2026-34330 | Win32k Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Win32K - GRFX | - | - | - |
| CVE-2026-34331 | Win32k Elevation of Privilege Vulnerability | Important | 7 |
Windows Win32K - GRFX | - | - | - |
| CVE-2026-34333 | Windows Win32k Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Win32K - GRFX | - | - | - |
| CVE-2026-34342 | Windows Print Spooler Elevation of Privilege Vulnerability | Important | 7 |
Windows Print Spooler Components | - | - | - |
| CVE-2026-34343 | Windows Application Identity (AppID) Subsystem Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Application Identity (AppID) Subsystem | - | - | - |
| CVE-2026-34344 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Ancillary Function Driver for WinSock | - | - | - |
| CVE-2026-34345 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important | 7 |
Windows Ancillary Function Driver for WinSock | - | - | - |
| CVE-2026-34347 | Windows Win32k Elevation of Privilege Vulnerability | Important | 7 |
Windows Win32K - GRFX | - | - | - |
| CVE-2026-34350 | Windows Storport Miniport Driver Denial of Service Vulnerability | Important | 6.5 |
Windows Storport Miniport Driver | - | - | - |
| CVE-2026-34351 | Windows TCP/IP Elevation of Privilege Vulnerability | Important | 7 |
Windows TCP/IP | - | - | - |
| CVE-2026-35415 | Windows Storage Spaces Controller Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Storage Spaces Controller | - | - | - |
| CVE-2026-35416 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important | 7 |
Windows Ancillary Function Driver for WinSock | - | - | - |
| CVE-2026-35417 | Windows Win32k Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Win32K - ICOMP | - | - | - |
| CVE-2026-35418 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Important | 7 |
Windows Cloud Files Mini Filter Driver | - | - | - |
| CVE-2026-35419 | Windows DWM Core Library Information Disclosure Vulnerability | Important | 5.5 |
Windows DWM Core Library | - | - | - |
| CVE-2026-35420 | Windows Kernel Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Kernel | - | - | - |
| CVE-2026-35421 | Windows GDI Remote Code Execution Vulnerability | Critical | 7.8 |
Windows GDI | - | - | - |
| CVE-2026-35422 | Windows TCP/IP Driver Security Feature Bypass Vulnerability | Important | 6.5 |
Windows TCP/IP | - | - | - |
| CVE-2026-35423 | Windows 11 Telnet Client Information Disclosure Vulnerability | Important | 5.4 |
Telnet Client | - | - | - |
| CVE-2026-35424 | Internet Key Exchange (IKE) Protocol Denial of Service Vulnerability | Important | 7.5 |
Windows Internet Key Exchange (IKE) Protocol | - | - | - |
| CVE-2026-35438 | Windows Admin Center Elevation of Privilege Vulnerability | Important | 8.3 |
Windows Admin Center | - | - | - |
| CVE-2026-35439 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Important | 8.8 |
Microsoft Office SharePoint | - | - | - |
| CVE-2026-35440 | Microsoft Word Information Disclosure Vulnerability | Important | 5.5 |
Microsoft Office Word | - | - | - |
| CVE-2026-40360 | Microsoft Excel Information Disclosure Vulnerability | Important | 7.8 |
Microsoft Office Excel | - | - | - |
| CVE-2026-40363 | Microsoft Office Remote Code Execution Vulnerability | Critical | 8.4 |
Microsoft Office | - | - | - |
| CVE-2026-40364 | Microsoft Word Remote Code Execution Vulnerability | Critical | 8.4 |
Microsoft Office Word | - | - | - |
| CVE-2026-40366 | Microsoft Word Remote Code Execution Vulnerability | Critical | 8.4 |
Microsoft Office Word | - | - | - |
| CVE-2026-40368 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Important | 8 |
Microsoft Office SharePoint | - | - | - |
| CVE-2026-40374 | Microsoft Power Automate Desktop Information Disclosure Vulnerability | Important | 6.5 |
Power Automate | - | - | - |
| CVE-2026-40377 | Microsoft Cryptographic Services Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Cryptographic Services | - | - | - |
| CVE-2026-40380 | Windows Volume Manager Extension Driver Remote Code Execution Vulnerability | Important | 6.2 |
Windows Volume Manager Extension Driver | - | - | - |
| CVE-2026-40399 | Windows TCP/IP Elevation of Privilege Vulnerability | Important | 7.8 |
Windows TCP/IP | - | - | - |
| CVE-2026-40405 | Windows TCP/IP Denial of Service Vulnerability | Important | 7.5 |
Windows TCP/IP | - | - | - |
| CVE-2026-40406 | Windows TCP/IP Information Disclosure Vulnerability | Important | 7.5 |
Windows TCP/IP | - | - | - |
| CVE-2026-40407 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Common Log File System Driver | - | - | Yes |
| CVE-2026-40408 | Windows WAN ARP Driver Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Kernel-Mode Drivers | - | - | - |
| CVE-2026-40410 | Windows SMB Client Elevation of Privilege Vulnerability | Important | 7 |
Windows SMB Client | - | - | - |
| CVE-2026-40414 | Windows TCP/IP Denial of Service Vulnerability | Important | 7.4 |
Windows TCP/IP | - | - | - |
| CVE-2026-40415 | Windows TCP/IP Remote Code Execution Vulnerability | Important | 8.1 |
Windows TCP/IP | - | - | - |
| CVE-2026-40417 | Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability | Important | 7.8 |
Dynamics Business Central | - | - | - |
| CVE-2026-40419 | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability | Important | 7.8 |
Microsoft Office | - | - | - |
| CVE-2026-40421 | Microsoft Word Information Disclosure Vulnerability | Important | 4.3 |
Microsoft Office Word | - | - | - |
| CVE-2026-41088 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Ancillary Function Driver for WinSock | - | - | - |
| CVE-2026-41089 | Windows Netlogon Remote Code Execution Vulnerability | Critical | 9.8 |
Windows Netlogon | - | - | - |
| CVE-2026-41094 | Microsoft Data Formulator Remote Code Execution Vulnerability | Important | 8.8 |
Microsoft Data Formulator | - | - | - |
| CVE-2026-41095 | Data Deduplication Elevation of Privilege Vulnerability | Important | 7.8 |
Data Deduplication | - | - | - |
| CVE-2026-41096 | Windows DNS Client Remote Code Execution Vulnerability | Critical | 9.8 |
Microsoft Windows DNS | - | - | - |
| CVE-2026-41101 | Microsoft Word for Android Spoofing Vulnerability | Important | 5.5 |
Microsoft Office Word | - | - | - |
| CVE-2026-41102 | Microsoft PowerPoint for Android Spoofing Vulnerability | Important | 5.5 |
Microsoft Office PowerPoint | - | - | - |
| CVE-2026-41109 | GitHub Copilot and Visual Studio Code Security Feature Bypass Vulnerability | Important | 8.8 |
GitHub Copilot and Visual Studio | - | - | - |
| CVE-2026-41610 | Visual Studio Code Security Feature Bypass Vulnerability | Important | 5 |
Visual Studio Code | - | - | - |
| CVE-2026-41611 | Visual Studio Code Remote Code Execution Vulnerability | Important | 3.3 |
Visual Studio Code | - | - | - |
| CVE-2026-41612 | Visual Studio Code Information Disclosure Vulnerability | Important | 5.5 |
Visual Studio Code | - | - | - |
| CVE-2026-41614 | M365 Copilot for Desktop Spoofing Vulnerability | Important | 6.2 |
M365 Copilot for Desktop | - | - | - |
| CVE-2026-32161 | Windows Native WiFi Miniport Driver Remote Code Execution Vulnerability | Critical | 7.5 |
Windows Native WiFi Miniport Driver | - | - | - |
| CVE-2026-32170 | Windows Rich Text Edit Elevation of Privilege Vulnerability | Important | 6.7 |
Windows Rich Text Edit Control | - | - | - |
| CVE-2026-32185 | Microsoft Teams Spoofing Vulnerability | Important | 5.5 |
Microsoft Teams | - | - | - |
| CVE-2026-42831 | Microsoft Office Remote Code Execution Vulnerability | Critical | 7.8 |
Microsoft Office | - | - | - |
| CVE-2026-32175 | .NET Core Tampering Vulnerability | Important | 4.3 |
.NET | - | - | - |
| CVE-2026-41107 | Microsoft Edge (Chromium-based) Information Disclosure Vulnerability | Moderate | 7.4 |
Microsoft Edge (Chromium-based) | - | - | - |
| CVE-2026-42825 | Windows Telephony Service Elevation of Privilege Vulnerability | Important | 7 |
Windows Telephony Service | - | - | - |
| CVE-2026-42891 | Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | Moderate | 6.5 |
Microsoft Edge (Chromium-based) | - | - | - |
| CVE-2026-35429 | Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | Moderate | 4.3 |
Microsoft Edge for Android | - | - | - |
| CVE-2026-42896 | Windows DWM Core Library Elevation of Privilege Vulnerability | Important | 7.8 |
Windows DWM Core Library | - | - | - |
| CVE-2026-42898 | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability | Critical | 9.9 |
Microsoft Dynamics 365 (on-premises) | - | - | - |
| CVE-2026-42899 | ASP.NET Core Denial of Service Vulnerability | Important | 7.5 |
ASP.NET Core | - | - | - |
| CVE-2026-42897 | Microsoft Exchange Server Spoofing Vulnerability | Critical | 6.1 |
Microsoft Exchange Server | Yes | - | - |
| CVE-2026-41615 | Microsoft Authenticator Information Disclosure Vulnerability | Critical | 7.4 |
Microsoft Authenticator | - | - | - |
| CVE-2026-45498 | Microsoft Defender Denial of Service Vulnerability | Low | 7.5 |
Microsoft Defender | Yes | Yes | - |
| CVE-2026-33110 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Important | 8.8 |
Microsoft Office SharePoint | - | - | - |
| CVE-2026-33112 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Important | 8.8 |
Microsoft Office SharePoint | - | - | - |
| CVE-2026-33833 | Azure Machine Learning Notebook Spoofing Vulnerability | Important | 8.2 |
Azure Machine Learning | - | - | - |
| CVE-2026-33835 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Cloud Files Mini Filter Driver | - | - | - |
| CVE-2026-33837 | Windows TCP/IP Local Elevation of Privilege Vulnerability | Important | 7.8 |
Windows TCP/IP | - | - | - |
| CVE-2026-33838 | Windows Message Queuing (MSMQ) Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Message Queuing | - | - | - |
| CVE-2026-34332 | Windows Kernel-Mode Driver Remote Code Execution Vulnerability | Important | 8 |
Windows Kernel-Mode Drivers | - | - | - |
| CVE-2026-34334 | Windows TCP/IP Elevation of Privilege Vulnerability | Important | 7 |
Windows TCP/IP | - | - | - |
| CVE-2026-34336 | Windows DWM Core Library Elevation of Privilege Vulnerability | Important | 7.8 |
Windows DWM Core Library | - | - | - |
| CVE-2026-34337 | Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability | Important | 7 |
Windows Cloud Files Mini Filter Driver | - | - | - |
| CVE-2026-34338 | Windows Telephony Service Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Telephony Service | - | - | - |
| CVE-2026-34339 | Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability | Important | 5.5 |
Windows LDAP - Lightweight Directory Access Protocol | - | - | - |
| CVE-2026-34340 | Windows Projected File System Elevation of Privilege Vulnerability | Important | 7 |
Windows Projected File System | - | - | - |
| CVE-2026-34341 | Windows Link-Layer Discovery Protocol (LLDP) Elevation of Privilege Vulnerability | Important | 7 |
Windows Link-Layer Discovery Protocol (LLDP) | - | - | - |
| CVE-2026-40357 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Important | 8.8 |
Microsoft Office SharePoint | - | - | - |
| CVE-2026-40358 | Microsoft Office Remote Code Execution Vulnerability | Critical | 8.4 |
Microsoft Office | - | - | - |
| CVE-2026-40359 | Microsoft Excel Remote Code Execution Vulnerability | Important | 7.8 |
Microsoft Office Excel | - | - | - |
| CVE-2026-40361 | Microsoft Outlook and Word Remote Code Execution Vulnerability | Critical | 8.4 |
Microsoft Office | - | - | - |
| CVE-2026-40362 | Microsoft Excel Remote Code Execution Vulnerability | Important | 7.8 |
Microsoft Office Excel | - | - | - |
| CVE-2026-40365 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Critical | 8.8 |
Microsoft Office SharePoint | - | - | - |
| CVE-2026-40367 | Microsoft Word Remote Code Execution Vulnerability | Critical | 8.4 |
Microsoft Office Word | - | - | - |
| CVE-2026-40370 | SQL Server Remote Code Execution Vulnerability | Important | 8.8 |
SQL Server | - | - | - |
| CVE-2026-40369 | Windows Kernel Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Kernel | - | - | - |
| CVE-2026-40382 | Windows Telephony Service Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Telephony Service | - | - | - |
| CVE-2026-40397 | Windows Common Log File System Driver Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Common Log File System Driver | - | - | Yes |
| CVE-2026-32209 | Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability | Important | 4.4 |
Windows Filtering Platform (WFP) | - | - | - |
| CVE-2026-40398 | Windows Remote Desktop Services Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Remote Desktop | - | - | - |
| CVE-2026-40401 | Windows TCP/IP Denial of Service Vulnerability | Important | 7.1 |
Windows TCP/IP | - | - | - |
| CVE-2026-40402 | Windows Hyper-V Elevation of Privilege Vulnerability | Critical | 9.3 |
Windows Hyper-V | - | - | - |
| CVE-2026-40403 | Windows Graphics Component Remote Code Execution Vulnerability | Critical | 8.8 |
Windows Win32K - GRFX | - | - | - |
| CVE-2026-40413 | Windows TCP/IP Denial of Service Vulnerability | Important | 7.4 |
Windows TCP/IP | - | - | - |
| CVE-2026-40418 | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability | Important | 7.8 |
Microsoft Office Click-To-Run | - | - | - |
| CVE-2026-35436 | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability | Important | 8.8 |
Microsoft Office Click-To-Run | - | - | - |
| CVE-2026-40420 | Microsoft Office Click-To-Run Elevation of Privilege Vulnerability | Important | 8.8 |
Microsoft Office Click-To-Run | - | - | - |
| CVE-2026-41086 | Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability | Important | 8.8 |
Windows Admin Center | - | - | - |
| CVE-2026-41097 | Secure Boot Security Feature Bypass Vulnerability | Important | 6.7 |
Windows Secure Boot | - | - | - |
| CVE-2026-40381 | Azure Connected Machine Agent Elevation of Privilege Vulnerability | Important | 7.8 |
Azure Connected Machine Agent | - | - | - |
| CVE-2026-41103 | Microsoft SSO Plugin for Jira & Confluence Elevation of Privilege Vulnerability | Critical | 9.1 |
Microsoft SSO Plugin for Jira & Confluence | - | - | - |
| CVE-2026-41613 | Visual Studio Code Elevation of Privilege Vulnerability | Important | 8.8 |
Visual Studio Code | - | - | - |
| CVE-2026-42823 | Azure Logic Apps Elevation of Privilege Vulnerability | Important | 9.9 |
Azure Logic Apps | - | - | - |
| CVE-2026-42830 | Azure Monitor Agent Metrics Extension Elevation of Privilege Vulnerability | Important | 6.5 |
Azure Monitor Agent | - | - | - |
| CVE-2026-42832 | Microsoft Office Spoofing Vulnerability | Important | 5.5 |
Microsoft Office | - | - | - |
| CVE-2026-42833 | Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability | Important | 9.1 |
Microsoft Dynamics 365 (on-premises) | - | - | - |
| CVE-2026-40416 | Microsoft Edge (Chromium-based) for Android Spoofing Vulnerability | Low | 4.3 |
Microsoft Edge (Chromium-based) | - | - | - |
| CVE-2026-42838 | Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability | Important | 5.4 |
Microsoft Edge (Chromium-based) | - | - | - |
| CVE-2026-42893 | Microsoft Outlook for iOS Tampering Vulnerability | Important | 7.5 |
M365 Copilot | - | - | - |
| CVE-2026-33821 | Microsoft Dynamics 365 Customer Insights Elevation of Privilege Vulnerability | Critical | 9.9 |
Microsoft Dynamics 365 Customer Insights | - | - | - |
| CVE-2026-45492 | Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability | Moderate | 5.4 |
Microsoft Edge (Chromium-based) | - | - | - |
| CVE-2026-45494 | Microsoft Edge (Chromium-based) Spoofing Vulnerability | Moderate | 6.1 |
Microsoft Edge (Chromium-based) | - | - | - |
| CVE-2026-45495 | Microsoft Edge (Chromium-based) Remote Code Execution Vulnerability | Important | 9.8 |
Microsoft Edge (Chromium-based) | - | - | - |
| CVE-2026-42822 | Azure Local Disconnected Operations (ALDO) Elevation of Privilege Vulnerability | Critical | 10 |
Azure Local Disconnected Operations | - | - | - |
| CVE-2026-45584 | Microsoft Defender Remote Code Execution Vulnerability | Critical | 8.1 |
Microsoft Defender | - | - | - |
| CVE-2026-42834 | Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability | Important | 7.8 |
Azure Portal Windows Admin Center | - | - | - |
| CVE-2026-45659 | Microsoft SharePoint Remote Code Execution Vulnerability | Important | 8.8 |
Microsoft Office SharePoint | - | - | - |
| CVE-2026-41091 | Microsoft Defender Elevation of Privilege Vulnerability | Important | 7.8 |
Microsoft Defender | Yes | Yes | - |
| CVE-2026-26129 | M365 Copilot Information Disclosure Vulnerability | Critical | 7.5 |
M365 Copilot | - | - | - |
| CVE-2026-33111 | Copilot Chat (Microsoft Edge) Information Disclosure Vulnerability | Critical | 7.5 |
Copilot Chat (Microsoft Edge) | - | - | - |
| CVE-2026-26164 | M365 Copilot Information Disclosure Vulnerability | Critical | 7.5 |
M365 Copilot | - | - | - |
| CVE-2026-33823 | Microsoft Team Events Portal Information Disclosure Vulnerability | Critical | 6.5 |
Microsoft Teams | - | - | - |
| CVE-2026-33844 | Azure Managed Instance for Apache Cassandra Remote Code Execution Vulnerability | Critical | 9 |
Azure Managed Instance for Apache Cassandra | - | - | - |
| CVE-2026-34327 | Microsoft Partner Center Spoofing Vulnerability | Critical | 8.2 |
Microsoft Partner Center | - | - | - |
| CVE-2026-35428 | Azure Cloud Shell Spoofing Vulnerability | Critical | 9.6 |
Azure Cloud Shell | - | - | - |
| CVE-2026-35435 | Azure AI Foundry Elevation of Privilege Vulnerability | Critical | 10 |
Azure AI Foundry M365 published agents | - | - | - |
| CVE-2026-42826 | Azure DevOps Information Disclosure Vulnerability | Critical | 7.5 |
Azure DevOps | - | - | - |
| CVE-2026-41105 | Azure Monitor Action Group Notification System Elevation of Privilege Vulnerability | Critical | 8.1 |
Azure Notification Service | - | - | - |
| CVE-2026-41104 | Microsoft Planetary Computer Pro Information Disclosure Vulnerability | Critical | 7.5 |
Microsoft Planetary Computer Pro | - | - | - |
| CVE-2026-42901 | Microsoft Entra ID Elevation of Privilege Vulnerability | Critical | 10 |
Microsoft Entra ID | - | - | - |
| CVE-2026-23663 | Microsoft Global Secure Access (GSA) Information Disclosure Vulnerability | Critical | 7.5 |
Azure Entra ID | - | - | - |
| CVE-2026-41100 | Microsoft 365 Copilot for Android Spoofing Vulnerability | Important | 4.4 |
M365 Copilot | - | - | - |
| CVE-2026-21530 | Windows Rich Text Edit Elevation of Privilege Vulnerability | Important | 6.7 |
Windows Rich Text Edit | - | - | - |
| CVE-2026-45585 | Windows BitLocker Security Feature Bypass Vulnerability | Important | 6.8 |
Windows BitLocker | - | Yes | - |
| CVE-2026-33840 | Win32k Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Win32K - ICOMP | - | - | - |
| CVE-2026-47294 | Microsoft SharePoint Server Remote Code Execution Vulnerability | Important | 8 |
Microsoft Office SharePoint | - | - | - |
| CVE-2026-33841 | Windows Kernel Elevation of Privilege Vulnerability | Important | 7.8 |
Windows Kernel | - | - | - |
| CVE-2026-35433 | .NET Elevation of Privilege Vulnerability | Important | 7.3 |
.NET | - | - | - |
| CVE-2026-32177 | .NET Elevation of Privilege Vulnerability | Important | 7.3 |
.NET | - | - | - |
Threat Categories 7
| Threat Category | CVEs | Critical |
|---|---|---|
| Elevation of Privilege | 69 | 11 |
| Remote Code Execution | 38 | 20 |
| Information Disclosure | 19 | 9 |
| Spoofing | 16 | 5 |
| Denial of Service | 9 | - |
| Security Feature Bypass | 8 | - |
| Tampering | 3 | 1 |
Affected Products 87
| Product | CVEs | Exploited |
|---|---|---|
| Windows TCP/IP | 11 | - |
| Microsoft Office SharePoint | 8 | - |
| Microsoft Edge (Chromium-based) | 7 | - |
| Microsoft Office | 6 | - |
| Microsoft Office Word | 6 | - |
| Windows Win32K - GRFX | 6 | - |
| M365 Copilot | 5 | - |
| Visual Studio Code | 4 | - |
| Windows Ancillary Function Driver for WinSock | 4 | - |
| .NET | 3 | - |
| Microsoft Defender | 3 | 2 |
| Microsoft Office Click-To-Run | 3 | - |
| Microsoft Office Excel | 3 | - |
| Windows Cloud Files Mini Filter Driver | 3 | - |
| Windows DWM Core Library | 3 | - |
| Windows Kernel | 3 | - |
| Windows Telephony Service | 3 | - |
| Azure Entra ID | 2 | - |
| Azure Machine Learning | 2 | - |
| Azure Managed Instance for Apache Cassandra | 2 | - |
| Azure Monitor Agent | 2 | - |
| Microsoft Dynamics 365 (on-premises) | 2 | - |
| Microsoft Teams | 2 | - |
| Windows Admin Center | 2 | - |
| Windows Common Log File System Driver | 2 | - |
| Windows Kernel-Mode Drivers | 2 | - |
| Windows Message Queuing | 2 | - |
| Windows Win32K - ICOMP | 2 | - |
| ASP.NET Core | 1 | - |
| Azure AI Foundry M365 published agents | 1 | - |
| Azure Cloud Shell | 1 | - |
| Azure Compute Gallery | 1 | - |
| Azure Connected Machine Agent | 1 | - |
| Azure DevOps | 1 | - |
| Azure Local Disconnected Operations | 1 | - |
| Azure Logic Apps | 1 | - |
| Azure Notification Service | 1 | - |
| Azure Orbital Spatio | 1 | - |
| Azure Portal Windows Admin Center | 1 | - |
| Azure Privileged Identity Management (PIM) | 1 | - |
| Azure Resource Manager (ARM) | 1 | - |
| Azure SDK | 1 | - |
| Azure Virtual Network Gateway | 1 | - |
| Copilot Chat (Microsoft Edge) | 1 | - |
| Data Deduplication | 1 | - |
| Dynamics Business Central | 1 | - |
| GitHub Copilot and Visual Studio | 1 | - |
| M365 Copilot for Desktop | 1 | - |
| Microsoft Authenticator | 1 | - |
| Microsoft Azure Active Directory B2C | 1 | - |
| Microsoft Copilot | 1 | - |
| Microsoft Data Formulator | 1 | - |
| Microsoft Dynamics 365 Customer Insights | 1 | - |
| Microsoft Edge for Android | 1 | - |
| Microsoft Entra ID | 1 | - |
| Microsoft Exchange Server | 1 | 1 |
| Microsoft Office PowerPoint | 1 | - |
| Microsoft Partner Center | 1 | - |
| Microsoft Planetary Computer Pro | 1 | - |
| Microsoft Power Pages | 1 | - |
| Microsoft SSO Plugin for Jira & Confluence | 1 | - |
| Microsoft Windows DNS | 1 | - |
| Power Automate | 1 | - |
| SQL Server | 1 | - |
| Telnet Client | 1 | - |
| Windows Application Identity (AppID) Subsystem | 1 | - |
| Windows BitLocker | 1 | - |
| Windows Cryptographic Services | 1 | - |
| Windows Event Logging Service | 1 | - |
| Windows Filtering Platform (WFP) | 1 | - |
| Windows GDI | 1 | - |
| Windows Hyper-V | 1 | - |
| Windows Internet Key Exchange (IKE) Protocol | 1 | - |
| Windows LDAP - Lightweight Directory Access Protocol | 1 | - |
| Windows Link-Layer Discovery Protocol (LLDP) | 1 | - |
| Windows Native WiFi Miniport Driver | 1 | - |
| Windows Netlogon | 1 | - |
| Windows Print Spooler Components | 1 | - |
| Windows Projected File System | 1 | - |
| Windows Remote Desktop | 1 | - |
| Windows Rich Text Edit | 1 | - |
| Windows Rich Text Edit Control | 1 | - |
| Windows SMB Client | 1 | - |
| Windows Secure Boot | 1 | - |
| Windows Storage Spaces Controller | 1 | - |
| Windows Storport Miniport Driver | 1 | - |
| Windows Volume Manager Extension Driver | 1 | - |