Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 4,355 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked 3 hours ago Checked every 6 hours
All vendor sources Official source

4,355 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-42976
HighCVSS 7.8

Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability

Missing authentication for critical function in Windows RPC API allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for x64-based Systems, Windows Server 2022, Windows Server 2022 (Server Core installation), Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9121, 10.0.20348.5499, 10.0.20348.5440, 10.0.19044.7663
Vendor guidance

Install KB5120238. Install KB5120242. Install KB5120229. Install KB5120249. Install KB5120233. Install KB5120228. Install KB5121003. Install KB5120994. Install KB5121000. Install KB5120418. Install KB5120386. Install ...

CVE-2026-42976
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-70348
HighCVSS 5.5

Windows Management Services Denial of Service Vulnerability

Improper link resolution before file access ('link following') in Windows Management Services allows an authorized attacker to deny service locally.

Affected productsWindows 11 Version 25H2 for ARM64-based Systems, Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 24H2 for ARM64-based Systems, Windows 11 Version 24H2 for x64-based Systems
Fixed versions10.0.26200.9168, 10.0.26200.9106, 10.0.26100.9168, 10.0.26100.9106
Vendor guidance

Install KB5121003. Install KB5120994. Install KB5121000.

CVE-2026-70348
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-68815
HighCVSS 7.8

Microsoft Excel Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office Excel allows an unauthorized attacker to execute code locally.

Affected productsOffice Online Server, Microsoft Office 2019 for 32-bit editions, Microsoft Office 2019 for 64-bit editions, Microsoft 365 Apps for Enterprise for 32-bit Systems
Fixed versions16.0.10417.20175, https://aka.ms/OfficeSecurityReleases, 16.112.26081010, 16.0.5565.1001
Vendor guidance

Click to Run Release Notes Install KB5002884. Install KB5002903.

CVE-2026-68815
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-62696
HighCVSS 7.8

Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability

Integer underflow (wrap or wraparound) in Windows Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.9121, 10.0.20348.5499, 10.0.20348.5440, 10.0.19044.7663
Vendor guidance

Install KB5120238. Install KB5120242. Install KB5120229. Install KB5120249. Install KB5120233. Install KB5120228. Install KB5121003. Install KB5120994. Install KB5120240. Install KB5121000. Install KB5120418.

CVE-2026-62696
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-19177
Severity not listed

CVE-2026-19177 Insufficient validation of untrusted input in UI

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)
Fixed versions151.0.4129.78
Vendor guidance

Release Notes

CVE-2026-19177
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-19169
Severity not listed

CVE-2026-19169 Insufficient validation of untrusted input in Contextual Tasks

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)
Fixed versions151.0.4129.78
Vendor guidance

Release Notes

CVE-2026-19169
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

Read how SecurityAlert collects and checks threat intelligence.