CVE-2026-62914

Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 7.3 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 5 more

CVE-2026-65665

Microsoft SharePoint Server Remote Code Execution Vulnerability

Deserialization of untrusted data in Microsoft Office SharePoint allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS 1.7% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2019 Sharepoint Server Subscription Edition

CVE-2026-65662

Windows GDI Information Disclosure Vulnerability

Out-of-bounds read in Windows GDI allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-65671

Remote Access API Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 22 more

CVE-2026-65672

Remote Access API Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Remote Access API allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 and 8 more

CVE-2026-65678

Windows Win32k Elevation of Privilege Vulnerability

Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 18 more

CVE-2026-65785

Windows DHCP Client Denial of Service Vulnerability

Uncontrolled resource consumption in Windows DHCP Client allows an unauthorized attacker to deny service over an adjacent network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 24h2 Windows 11 24h2 Windows 11 25h2 and 5 more

CVE-2026-65784

Windows NTFS Information Disclosure Vulnerability

Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-65786

Desktop Window Manager Elevation of Privilege Vulnerability

Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 18 more

CVE-2026-65787

Desktop Window Manager Elevation of Privilege Vulnerability

Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 19 more

CVE-2026-65788

Desktop Window Manager Elevation of Privilege Vulnerability

Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 11 23h2 Windows 11 23h2 Windows 11 24h2 and 7 more

CVE-2026-65814

Microsoft Windows Storage Port Driver Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Storage Port Driver allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-66799

Windows Key Guard Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Key Guard allows an authorized attacker to elevate privileges locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Windows 10 1607 Windows 10 1809 Windows 10 21h2 and 23 more

CVE-2026-68809

Powerpoint Information Disclosure Vulnerability

Incomplete cleanup in Microsoft Office PowerPoint allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Apps For Enterprise Office 2019 and 4 more

CVE-2026-70318

Microsoft Excel Information Disclosure Vulnerability

Improper input validation in Microsoft Office Excel allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 11 more

CVE-2026-70317

Microsoft Office Information Disclosure Vulnerability

Use of uninitialized resource in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 10 more

CVE-2026-62842

Microsoft Office Graphics Component Information Disclosure Vulnerability

Out-of-bounds read in Microsoft Office allows an unauthorized attacker to disclose information locally.

CVSS 3.1 · 5.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft Office 365 For Mac and 10 more

CVE-2026-64897

Microsoft SharePoint Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Office SharePoint allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 4.6 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Sharepoint Server Sharepoint Server 2016 Sharepoint Server 2019 and 1 more

CVE-2026-64910

Microsoft Office Remote Code Execution Vulnerability

Untrusted pointer dereference in Microsoft Office allows an unauthorized attacker to execute code locally.

CVSS 3.1 · 7.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

365 Apps Microsoft 365 Microsoft 365 Apps For Enterprise and 9 more

CVE-2026-58612

PowerShell Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Microsoft PowerShell Core allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 7.4 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Powershell