Search threats, CVEs… ⌘K
Vendor advisories

Microsoft Security Response Center

Browse 17,776 advisories from this official source. Search by product, CVE, severity, or advisory ID.

Current Checked about an hour ago Checked every 6 hours
All vendor sources Official source

17,776 advisories

Each date says whether the vendor published or updated the bulletin. A vendor bulletin describes products that may be affected. It does not prove that the vulnerable product or version is installed in your environment.

RSS for these results
Microsoft Security Response CenterCVE-2026-11263
Severity not listed

Chromium: CVE-2026-11263 Insufficient policy enforcement in WebAuthentication

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)
Fixed versions149.0.4022.53
Vendor guidance

Release Notes

CVE-2026-11263
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-11045
Severity not listed

Chromium: CVE-2026-11045 Insufficient validation of untrusted input in GPU

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)
Fixed versions149.0.4022.53
Vendor guidance

Release Notes

CVE-2026-11045
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-11097
Severity not listed

Chromium: CVE-2026-11097 Inappropriate implementation in WebView

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.

Affected productsMicrosoft Edge (Chromium-based)
Fixed versions149.0.4022.53
Vendor guidance

Release Notes

CVE-2026-11097
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-50507
HighCVSS 6.8

Windows BitLocker Security Feature Bypass Vulnerability

Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8880, 10.0.20348.5256, 10.0.19044.7417, 10.0.19045.7417
Vendor guidance

Install KB5094123. Install KB5094128. Install KB5094127. Install KB5094126. Install KB5093998. Install KB5095051. Install KB5094122. Install KB5094041.

CVE-2026-50507
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-45585
HighCVSS 6.8

Windows BitLocker Security Feature Bypass Vulnerability

Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guid...

Affected productsWindows Server 2025 (Server Core installation), Windows 11 Version 25H2 for x64-based Systems, Windows 11 Version 24H2 for x64-based Systems, Windows Server 2025
Fixed versions10.0.26100.32995, 10.0.26200.8655, 10.0.26100.8655, 10.0.28000.2269
Vendor guidance

Install KB5094125. Install KB5094126. Install KB5095051.

CVE-2026-45585
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-43582
CriticalCVSS 8.1

Remote Desktop Protocol Server Remote Code Execution Vulnerability

How could an attacker exploit this vulnerability? To exploit this vulnerability, an unauthenticated attacker would need to send malformed packets to a websocket listening port. This could result in remote code execution on the server side with the same permissions as the webso...

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.6414, 10.0.20348.2762, 10.0.22000.3260, 10.0.19044.5011
Vendor guidance

Install KB5044277. Install KB5044281. Install KB5044280. Install KB5044273. Install KB5044285. Install KB5044288. Install KB5044284. Install KB5095051.

CVE-2024-43582
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-49132
CriticalCVSS 8.1

Windows Remote Desktop Services Remote Code Execution Vulnerability

How could an attacker exploit this vulnerability? An attacker could successfully exploit this vulnerability by attempting to connect to a system with the Remote Desktop Gateway role, triggering the race condition to create a use-after-free scenario, and then leveraging this to...

Affected productsWindows 11 Version 26H1 for ARM64-based Systems, Windows 11 version 26H1 for x64-based Systems, Windows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems
Fixed versions10.0.28000.2269, 10.0.17763.6659, 10.0.20348.2966, 10.0.20348.2908
Vendor guidance

Install KB5095051. Install KB5048661. Install KB5048654. Install KB5048800. Install KB5048652. Install KB5048685. Install KB5048667. Install KB5048794. Install KB5048653.

CVE-2024-49132
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2024-49123
CriticalCVSS 8.1

Windows Remote Desktop Services Remote Code Execution Vulnerability

How could an attacker exploit this vulnerability? An attacker could successfully exploit this vulnerability by attempting to connect to a system with the Remote Desktop Gateway role, triggering the race condition to create a use-after-free scenario, and then leveraging this to...

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.6659, 10.0.20348.2966, 10.0.20348.2908, 10.0.19044.5247
Vendor guidance

Install KB5048661. Install KB5048654. Install KB5048800. Install KB5048652. Install KB5048685. Install KB5048667. Install KB5048794. Install KB5048653. Install KB5095051.

CVE-2024-49123
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-48574
CriticalCVSS 7.8

Windows Media Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code locally.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8880, 10.0.20348.5256, 10.0.19044.7417, 10.0.19045.7417
Vendor guidance

Install KB5094123. Install KB5094128. Install KB5094127. Install KB5094125. Install KB5094126. Install KB5093998. Install KB5095051. Install KB5094122. Install KB5094042. Install KB5094041.

CVE-2026-48574
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-48563
CriticalCVSS 7.5

Remote Desktop Client Remote Code Execution Vulnerability

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8880, 10.0.20348.5256, 10.0.19044.7417, 10.0.19045.7417
Vendor guidance

Install KB5094123. Install KB5094128. Install KB5094127. Install KB5094125. Install KB5094126. Install KB5093998. Install KB5095051.

CVE-2026-48563
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-47654
CriticalCVSS 7.5

Remote Desktop Client Remote Code Execution Vulnerability

Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Affected productsWindows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022 (Server Core installation)
Fixed versions10.0.17763.8880, 10.0.20348.5256, 10.0.26100.32995, 10.0.14393.9234
Vendor guidance

Install KB5094123. Install KB5094128. Install KB5094125. Install KB5094122.

CVE-2026-47654
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-47652
CriticalCVSS 8.2

Windows Hyper-V Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

Affected productsWindows Server 2022, Windows Server 2022 (Server Core installation), Windows Server 2025 (Server Core installation), Windows 11 Version 25H2 for ARM64-based Systems
Fixed versions10.0.20348.5256, 10.0.26100.32995, 10.0.26200.8655, 10.0.22631.7219
Vendor guidance

Install KB5094128. Install KB5094125. Install KB5094126. Install KB5093998. Install KB5095051.

CVE-2026-47652
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-47635
CriticalCVSS 8.4

Microsoft Outlook and Word Remote Code Execution Vulnerability

Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally.

Affected productsMicrosoft Office LTSC 2024 for 32-bit editions, Microsoft Office LTSC 2024 for 64-bit editions
Fixed versionshttps://aka.ms/OfficeSecurityReleases
Vendor guidance

Click to Run

CVE-2026-47635
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-47291
CriticalCVSS 9.8

HTTP.sys Remote Code Execution Vulnerability

Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8880, 10.0.20348.5256, 10.0.19044.7417, 10.0.19045.7417
Vendor guidance

To help protect against this vulnerability prior to installing the June 2026 security updates for your operating system, you may need to modify the MaxRequestBytes registry value used by the Windows HTTP stack if it i...

CVE-2026-47291
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-47289
CriticalCVSS 8.8

Remote Desktop Client Remote Code Execution Vulnerability

Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.

Affected productsWindows 10 Version 1809 for 32-bit Systems, Windows 10 Version 1809 for x64-based Systems, Windows Server 2019, Windows Server 2019 (Server Core installation)
Fixed versions10.0.17763.8880, 10.0.20348.5256, 10.0.19044.7417, 10.0.19045.7417
Vendor guidance

Release Notes Install KB5094123. Install KB5094128. Install KB5094127. Install KB5094125. Install KB5094126. Install KB5093998. Install KB5095051. Install KB5094122. Install KB5094042. Install KB5094041.

CVE-2026-47289
Read the vendor advisory Watch this product
Microsoft Security Response CenterCVE-2026-47288
CriticalCVSS 7.1

Windows Kerberos Key Distribution Center (KDC) Remote Code Execution

Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network.

Affected productsWindows Server 2019, Windows Server 2019 (Server Core installation), Windows Server 2022, Windows Server 2022 (Server Core installation)
Fixed versions10.0.17763.8880, 10.0.20348.5256, 10.0.26100.32995, 10.0.14393.9234
Vendor guidance

Install KB5094123. Install KB5094128. Install KB5094125. Install KB5094122. Install KB5094042. Install KB5094041.

CVE-2026-47288
Read the vendor advisory Watch this product
Before you act

Start with the vendor's bulletin.

We normalize the fields that vendors publish so you can search and compare advisories in one place. We do not replace the original bulletin or turn a product-name match into proof that a system is vulnerable.

Confirm the installed product and version, read the linked vendor guidance, and test the recommended update or mitigation through your normal change process.

How we check our sources