CVE tracker

Microsoft Patch Tuesday

What Microsoft fixes on the second Tuesday of every month – straight from the official Security Update Guide: number of vulnerabilities, critical and already exploited ones (zero-days), affected products and the history of the last 24 months.

181vulnerabilities fixed (CVEs)

23of them critical

2exploited (zero-day)

1publicly disclosed

Tue, 10 Nov 2026Next Patch Tuesday
in 10 days and 0 hours

← Back to the month overview

All CVEs – Patch Tuesday April 2026

181 vulnerabilities

CVE-2026-32201ImportantCVSS 6.5Exploited (zero-day)Spoofing

Microsoft SharePoint Server Spoofing Vulnerability

Microsoft Office · KB5002861 KB5002854 KB5002853 · MSRC

CVE-2026-32202ImportantCVSS 4.3Exploited (zero-day)Spoofing

Windows Shell Spoofing Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5099538 KB5099540 KB5099539 KB5099536 · MSRC

CVE-2026-32186CriticalCVSS 10.0Elevation of privilege

Microsoft Bing Elevation of Privilege Vulnerability

Apps · MSRC

CVE-2026-32213CriticalCVSS 10.0Elevation of privilege

Azure AI Foundry Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2026-33105CriticalCVSS 10.0Elevation of privilege

Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2026-33107CriticalCVSS 10.0Elevation of privilege

Azure Databricks Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2026-33819CriticalCVSS 10.0Remote code execution

Microsoft Bing Remote Code Execution Vulnerability

Apps · MSRC

CVE-2026-35431CriticalCVSS 10.0Spoofing

Microsoft Entra ID Entitlement Management Spoofing Vulnerability

Azure · MSRC

CVE-2026-21515CriticalCVSS 9.9Elevation of privilege

Azure IoT Central Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2026-33824CriticalCVSS 9.8Remote code execution

Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082200 KB5082063 · MSRC

CVE-2026-24303CriticalCVSS 9.6Elevation of privilege

Microsoft Partner Center Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2026-26135CriticalCVSS 9.6Elevation of privilege

Azure Custom Locations Resource Provider (RP) Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2026-32210CriticalCVSS 9.3Spoofing

Microsoft Dynamics 365 (online) Spoofing Vulnerability

Microsoft Dynamics · MSRC

CVE-2026-33102CriticalCVSS 9.3Elevation of privilege

Microsoft 365 Copilot Elevation of Privilege Vulnerability

Apps · MSRC

CVE-2026-32211CriticalCVSS 9.1Information disclosure

Azure MCP Server Information Disclosure Vulnerability

Azure · MSRC

CVE-2026-32157CriticalCVSS 8.8Remote code execution

Remote Desktop Client Remote Code Execution Vulnerability

Windows · KB5083768 · MSRC

CVE-2026-26150CriticalCVSS 8.6Elevation of privilege

Microsoft Purview eDiscovery Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2026-32173CriticalCVSS 8.6Information disclosure

Azure SRE Agent Information Disclosure Vulnerability

Azure · MSRC

CVE-2026-32190CriticalCVSS 8.4Remote code execution

Microsoft Office Remote Code Execution Vulnerability

Microsoft Office · KB5002859 · MSRC

CVE-2026-33114CriticalCVSS 8.4Remote code execution

Microsoft Word Remote Code Execution Vulnerability

Microsoft Office · MSRC

CVE-2026-33115CriticalCVSS 8.4Remote code execution

Microsoft Word Remote Code Execution Vulnerability

Microsoft Office · MSRC

CVE-2026-33827CriticalCVSS 8.1Remote code execution

Windows TCP/IP Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082200 KB5082063 · MSRC

CVE-2026-32172CriticalCVSS 8.0Remote code execution

Microsoft Power Apps Remote Code Execution Vulnerability

Microsoft Dynamics · MSRC

CVE-2026-33826CriticalCVSS 8.0Remote code execution

Windows Active Directory Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082063 KB5082060 · MSRC

CVE-2026-23666CriticalCVSS 7.5Denial of service

.NET Framework Denial of Service Vulnerability

Developer tools (.NET, Visual Studio …) · KB5082411 KB5082403 KB5082404 KB5082414 · MSRC

CVE-2026-40372ImportantCVSS 9.1Elevation of privilege

ASP.NET Core Elevation of Privilege Vulnerability

Developer tools (.NET, Visual Studio …) · KB5091596 · MSRC

CVE-2026-26149ImportantCVSS 9.0Spoofing

Microsoft Power Apps Desktop Client Spoofing Vulnerability

Azure · MSRC

CVE-2026-26167ImportantCVSS 8.8Elevation of privilege

Windows Push Notifications Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5083768 KB5082123 KB5082142 KB5082200 · MSRC

CVE-2026-26178ImportantCVSS 8.8Elevation of privilege

Windows Advanced Rasterization Platform Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082200 KB5082063 · MSRC

CVE-2026-32171ImportantCVSS 8.8Elevation of privilege

Azure Logic Apps Elevation of Privilege Vulnerability

Azure · MSRC

CVE-2026-32225ImportantCVSS 8.8Security feature bypass

Windows Shell Security Feature Bypass Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082200 KB5082063 · MSRC

CVE-2026-33120ImportantCVSS 8.8Remote code execution

Microsoft SQL Server Remote Code Execution Vulnerability

SQL Server · KB5084815 · MSRC

CVE-2026-27928ImportantCVSS 8.7Security feature bypass

Windows Hello Security Feature Bypass Vulnerability

Windows · KB5082123 KB5082142 KB5082063 KB5082060 · MSRC

CVE-2026-32091ImportantCVSS 8.4Elevation of privilege

Microsoft Brokering File System Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082200 KB5082063 · MSRC

CVE-2026-32162ImportantCVSS 8.4Elevation of privilege

Windows COM Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082200 KB5082063 · MSRC

CVE-2026-32221ImportantCVSS 8.4Remote code execution

Windows Graphics Component Remote Code Execution Vulnerability

Windows · KB5082063 KB5083769 KB5083768 · MSRC

CVE-2026-27912ImportantCVSS 8.0Elevation of privilege

Windows Kerberos Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082063 KB5082060 · MSRC

CVE-2026-20930ImportantCVSS 7.8Elevation of privilege

Windows Management Services Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082200 KB5082063 · MSRC

CVE-2026-23657ImportantCVSS 7.8Remote code execution

Microsoft Word Remote Code Execution Vulnerability

Microsoft Office · MSRC

CVE-2026-26143ImportantCVSS 7.8Security feature bypass

Microsoft PowerShell Security Feature Bypass Vulnerability

Developer tools (.NET, Visual Studio …) · MSRC

CVE-2026-26153ImportantCVSS 7.8Elevation of privilege

Windows Encrypted File System (EFS) Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5083768 KB5082123 KB5082142 KB5082200 · MSRC

CVE-2026-26156ImportantCVSS 7.8Remote code execution

Windows Hyper-V Remote Code Execution Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5083768 KB5082123 KB5082142 KB5082200 · MSRC

CVE-2026-26159ImportantCVSS 7.8Elevation of privilege

Remote Desktop Licensing Service Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082200 KB5082063 · MSRC

CVE-2026-26160ImportantCVSS 7.8Elevation of privilege

Remote Desktop Licensing Service Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5083768 KB5082123 KB5082142 KB5082200 · MSRC

CVE-2026-26161ImportantCVSS 7.8Elevation of privilege

Windows Sensor Data Service Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082123 KB5082142 KB5082200 KB5082063 · MSRC

CVE-2026-26162ImportantCVSS 7.8Elevation of privilege

Windows OLE Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5083768 KB5082123 KB5082142 KB5082200 · MSRC

CVE-2026-26163ImportantCVSS 7.8Elevation of privilege

Windows Kernel Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5083768 KB5082123 KB5082142 KB5082200 · MSRC

CVE-2026-26168ImportantCVSS 7.8Elevation of privilege

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5083768 KB5082123 KB5082142 KB5082200 · MSRC

CVE-2026-26170ImportantCVSS 7.8Elevation of privilege

PowerShell Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5083768 KB5082123 KB5082142 KB5082200 · MSRC

CVE-2026-26172ImportantCVSS 7.8Elevation of privilege

Windows Push Notifications Elevation of Privilege Vulnerability

Windows, Windows ESU (Extended Security Updates) · KB5082142 KB5082200 KB5082063 KB5083769 · MSRC

Sources

The tracker combines official, freely usable data sources – updated continuously:

NVD (NIST) – CVEs, rating (CVSS), affected products
CISA KEV – vulnerabilities confirmed by CISA as actively exploited
CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
FIRST EPSS – probability of exploitation
Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
PoC-in-GitHub – public proof-of-concept repositories
Metasploit (Rapid7) – modules of the Metasploit Framework
Exploit-DB (OffSec) – archive of public exploits (links only)
Patch days: official vendor pages (linked per vendor) (Vendor patch days)

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touch RSS feed