How many CVEs does microsoft have?

microsoft has 25,661 published CVE records since 1999, including 4,887 in the last two years.

How many microsoft CVEs are in CISA KEV?

Yes — 486 of microsoft's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.

Which microsoft products have the most CVEs?

The microsoft products with the most published CVEs are Windows, Windows Server 2016, Windows Server 2019, Windows Server 2012, Windows 10.

What are the most common weakness types in microsoft CVEs?

microsoft's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-125 (Out-of-bounds Read), CWE-122 (Heap-based Buffer Overflow), CWE-787 (Out-of-bounds Write).

How many critical microsoft vulnerabilities are there?

microsoft has 4,137 critical and 13,761 high-severity CVEs.

What is the average severity of microsoft CVEs?

The average CVSS base score across microsoft's scored CVEs is 7.4.

RadicalNotion.AI

Log in Start free

Log in

Log in Start free

25,661 CVEs

486 in CISA KEV

microsoft Vulnerabilities

Name: microsoft vulnerability dataset (CVEs)
Creator: RadicalNotion.AI
License: https://creativecommons.org/licenses/by-nc/4.0/

CVE security advisories and vulnerability history for microsoft.

25,661

Total CVEs

Published

486

In CISA KEV

Exploited in the wild

2,861

Public exploits

PoC or exploit code

7.4

Avg CVSS

1999–2026

Overview

microsoft has 25,661 published CVE records since 1999, of which 486 are in CISA's Known Exploited Vulnerabilities catalog and 2,861 have a known public exploit. The average CVSS base score across scored CVEs is 7.4.

This page aggregates every publicly disclosed vulnerability (CVE) affecting microsoft products, with severity breakdowns, the most-affected products, the most common weakness types, and the latest disclosures.

Security scorecard

A quick read on microsoft's vulnerability posture, as a share of its 25,661 published CVEs.

Average CVSS: 7.4
Critical / high: 70%
Actively exploited (KEV): 2%
Public exploit available: 11%
Patch available: 57%

Severity and exploitation

How the CVSS severity of microsoft's CVEs breaks down, plus how many are exploited in the wild or have public exploit code.

Critical4,137

High13,761

Medium7,217

Low546

In CISA’s Known Exploited Vulnerabilities catalog

486

486 of microsoft's CVEs are confirmed exploited in the wild.

Public exploits

2,861

2,861 of microsoft's CVEs have a known public exploit available.

Most affected products

The microsoft products with the most published CVEs. Follow any product to browse its versions and vulnerabilities.

Common weakness types

The CWE weakness categories most often found in microsoft CVEs. Follow any weakness for its full explanation.

CNAs that assign these CVEs

The CVE Numbering Authorities that publish microsoft CVE records.

Disclosure activity by year

How many microsoft CVEs were published each year.

2019

1,854

2020

1,885

2021

1,714

2022

1,757

2023

1,953

2024

1,804

2025

1,950

2026

2,937

Latest microsoft CVEs

The most recently disclosed vulnerabilities affecting microsoft.

Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability
CWE-359
High · CVSS 7.1
EPSS 0.6%2026-07-17
Microsoft Edge (Chromium-based) Tampering Vulnerability
CWE-288
Medium · CVSS 5.4
EPSS 0.2%2026-07-17
Microsoft SharePoint Server Spoofing Vulnerability
CWE-79
Medium · CVSS 4.6
EPSS 0.2%2026-07-16
Windows Backup Service Elevation of Privilege Vulnerability
CWE-362
High · CVSS 7.0
EPSS 0.2%2026-07-16
Windows Admin Center Spoofing Vulnerability
CWE-79
Medium · CVSS 6.1
EPSS 0.2%2026-07-16
Windows Terminal Remote Code Execution Vulnerability
CWE-190
High · CVSS 7.5
EPSS 0.5%2026-07-16
Microsoft UFO: COMMAND_RESULTS handler creates unowned sessions, allowing authenticated session-squatting denial of service
CWE-400
Medium · CVSS 6.5
EPSS 0.7%2026-07-16
Microsoft UFO: Missing Authorization in DEVICE_INFO_REQUEST Allows a DEVICE Client to Read Another Device's system_info
CWE-639
Medium · CVSS 4.3
EPSS 0.5%2026-07-16
SimpleChat plugin validation endpoints missing authentication and authorization
CWE-306
High · CVSS 8.6
EPSS 0.9%2026-07-16
SimpleChat: Authenticated users can access other users' profile metadata through user IDOR endpoints
CWE-200
Medium · CVSS 4.3
EPSS 0.5%2026-07-16
Prompty: Arbitrary File Read via ${file:path} Reference Expansion
CWE-22
High · CVSS 7.5
EPSS 1.1%2026-07-16
Prompty: Arbitrary code execution via JavaScript frontmatter in TypeScript loader
CWE-94
High · CVSS 8.7
EPSS 0.9%2026-07-16

Track new microsoft CVEs as they are disclosed and get AI-written analysis and remediation guidance.

Monitor microsoft CVEs

Other vendors

Browse vulnerabilities for other tracked vendors.

linux20,234 CVEs Google15,651 CVEs Apple14,759 CVEs Oracle10,707 CVEs Debian10,221 CVEs IBM8,380 CVEs Red Hat7,778 CVEs Adobe7,522 CVEs

Browse all vendors

Frequently asked questions

Common questions about microsoft vulnerabilities.

How many CVEs does microsoft have?: microsoft has 25,661 published CVE records since 1999, including 4,887 in the last two years.
How many microsoft CVEs are in CISA KEV?: Yes — 486 of microsoft's CVEs are listed in CISA's Known Exploited Vulnerabilities catalog, confirmed exploited in the wild and carrying a CISA remediation deadline.
Which microsoft products have the most CVEs?: The microsoft products with the most published CVEs are Windows, Windows Server 2016, Windows Server 2019, Windows Server 2012, Windows 10.
What are the most common weakness types in microsoft CVEs?: microsoft's CVEs most often map to these CWE weakness types: CWE-416 (Use After Free), CWE-125 (Out-of-bounds Read), CWE-122 (Heap-based Buffer Overflow), CWE-787 (Out-of-bounds Write).
Are there public exploits for microsoft vulnerabilities?: Yes — 2,861 of microsoft's CVEs have a known public exploit.
How many critical microsoft vulnerabilities are there?: microsoft has 4,137 critical and 13,761 high-severity CVEs.
What is the average severity of microsoft CVEs?: The average CVSS base score across microsoft's scored CVEs is 7.4.

References

Vulnerability data is sourced from the CVE Program; severity, KEV, and exploit signals are aggregated by RadicalNotion.AI.

Track microsoft vulnerabilities

Monitor new microsoft vulnerabilities as they are disclosed, with AI-written analysis and remediation guidance.

Start free See pricing