{"as_of":"2026-09-17T11:22:47.904Z","catalog_version":"2026.09.16","catalog_released":"2026-09-16T18:47:50.6796Z","catalog_size":1713,"matched":388,"count":25,"entries":[{"cve_id":"CVE-2026-81963","vendor":"Microsoft","product":"Windows","vulnerability_name":"Microsoft Windows Link Following Vulnerability","date_added":"2026-09-08","due_date":"2026-09-22","days_since_added":9,"days_until_due":5,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-59","CWE-284"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-81963"},{"cve_id":"CVE-2026-85880","vendor":"Microsoft","product":"Windows","vulnerability_name":"Microsoft Windows Heap-Based Buffer Overflow Vulnerability","date_added":"2026-09-08","due_date":"2026-09-22","days_since_added":9,"days_until_due":5,"past_due":false,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-122","CWE-908"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-85880"},{"cve_id":"CVE-2019-1068","vendor":"Microsoft","product":"SQL Server","vulnerability_name":"Microsoft SQL Server Remote Code Execution Vulnerability","date_added":"2026-08-26","due_date":"2026-08-29","days_since_added":22,"days_until_due":-19,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":[],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2019-1068"},{"cve_id":"CVE-2026-33824","vendor":"Microsoft","product":"Internet Key Exchange (IKE) Service Extensions","vulnerability_name":"Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability","date_added":"2026-08-18","due_date":"2026-08-21","days_since_added":30,"days_until_due":-27,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-415"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-33824"},{"cve_id":"CVE-2026-55040","vendor":"Microsoft","product":"SharePoint","vulnerability_name":"Microsoft SharePoint Weak Authentication Vulnerability","date_added":"2026-08-18","due_date":"2026-08-21","days_since_added":30,"days_until_due":-27,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-1390"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-55040"},{"cve_id":"CVE-2026-68820","vendor":"Microsoft","product":"Windows Ancillary Function Driver for WinSock ","vulnerability_name":"Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability","date_added":"2026-08-11","due_date":"2026-08-25","days_since_added":37,"days_until_due":-23,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-416"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-68820"},{"cve_id":"CVE-2026-50522","vendor":"Microsoft","product":"SharePoint","vulnerability_name":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability ","date_added":"2026-07-22","due_date":"2026-07-25","days_since_added":57,"days_until_due":-54,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-50522"},{"cve_id":"CVE-2026-58644","vendor":"Microsoft","product":"SharePoint","vulnerability_name":"Microsoft SharePoint Deserialization of Untrusted Data Vulnerability","date_added":"2026-07-16","due_date":"2026-07-19","days_since_added":63,"days_until_due":-60,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-58644"},{"cve_id":"CVE-2026-56155","vendor":"Microsoft","product":"Active Directory Federation Services","vulnerability_name":"Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability ","date_added":"2026-07-14","due_date":"2026-07-28","days_since_added":65,"days_until_due":-51,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-1220"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-56155"},{"cve_id":"CVE-2026-56164","vendor":"Microsoft","product":"SharePoint Server","vulnerability_name":"Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability","date_added":"2026-07-14","due_date":"2026-07-17","days_since_added":65,"days_until_due":-62,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-306"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-56164"},{"cve_id":"CVE-2026-45659","vendor":"Microsoft","product":"SharePoint Server","vulnerability_name":"Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability","date_added":"2026-07-01","due_date":"2026-07-04","days_since_added":78,"days_until_due":-75,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","cwes":["CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45659"},{"cve_id":"CVE-2008-4250","vendor":"Microsoft","product":"Windows","vulnerability_name":"Microsoft Windows Buffer Overflow Vulnerability","date_added":"2026-05-20","due_date":"2026-06-03","days_since_added":120,"days_until_due":-106,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-94"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2008-4250"},{"cve_id":"CVE-2009-1537","vendor":"Microsoft","product":"DirectX","vulnerability_name":"Microsoft DirectX NULL Byte Overwrite Vulnerability","date_added":"2026-05-20","due_date":"2026-06-03","days_since_added":120,"days_until_due":-106,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":[],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2009-1537"},{"cve_id":"CVE-2010-0249","vendor":"Microsoft","product":"Internet Explorer","vulnerability_name":"Microsoft Internet Explorer Use-After-Free Vulnerability","date_added":"2026-05-20","due_date":"2026-06-03","days_since_added":120,"days_until_due":-106,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-416"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2010-0249"},{"cve_id":"CVE-2010-0806","vendor":"Microsoft","product":"Internet Explorer","vulnerability_name":"Microsoft Internet Explorer Use-After-Free Vulnerability","date_added":"2026-05-20","due_date":"2026-06-03","days_since_added":120,"days_until_due":-106,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-399"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2010-0806"},{"cve_id":"CVE-2026-41091","vendor":"Microsoft","product":"Defender","vulnerability_name":"Microsoft Defender Link Following Vulnerability","date_added":"2026-05-20","due_date":"2026-06-03","days_since_added":120,"days_until_due":-106,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-59"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-41091"},{"cve_id":"CVE-2026-45498","vendor":"Microsoft","product":"Defender","vulnerability_name":"Microsoft Defender Denial of Service Vulnerability","date_added":"2026-05-20","due_date":"2026-06-03","days_since_added":120,"days_until_due":-106,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":[],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-45498"},{"cve_id":"CVE-2026-42897","vendor":"Microsoft","product":"Microsoft","vulnerability_name":"Microsoft Exchange Server Cross-Site Scripting Vulnerability","date_added":"2026-05-15","due_date":"2026-05-29","days_since_added":125,"days_until_due":-111,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-79"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-42897"},{"cve_id":"CVE-2026-32202","vendor":"Microsoft","product":"Windows","vulnerability_name":"Microsoft Windows Protection Mechanism Failure Vulnerability","date_added":"2026-04-28","due_date":"2026-05-12","days_since_added":142,"days_until_due":-128,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-693"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-32202"},{"cve_id":"CVE-2026-33825","vendor":"Microsoft","product":"Defender","vulnerability_name":"Microsoft Defender Insufficient Granularity of Access Control Vulnerability","date_added":"2026-04-22","due_date":"2026-05-06","days_since_added":148,"days_until_due":-134,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-1220"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-33825"},{"cve_id":"CVE-2009-0238","vendor":"Microsoft","product":"Office","vulnerability_name":"Microsoft Office Remote Code Execution","date_added":"2026-04-14","due_date":"2026-04-28","days_since_added":156,"days_until_due":-142,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-94"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2009-0238"},{"cve_id":"CVE-2026-32201","vendor":"Microsoft","product":"SharePoint Server","vulnerability_name":"Microsoft SharePoint Server Improper Input Validation Vulnerability","date_added":"2026-04-14","due_date":"2026-04-28","days_since_added":156,"days_until_due":-142,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-20"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2026-32201"},{"cve_id":"CVE-2012-1854","vendor":"Microsoft","product":"Visual Basic for Applications (VBA)","vulnerability_name":"Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability","date_added":"2026-04-13","due_date":"2026-04-27","days_since_added":157,"days_until_due":-143,"past_due":true,"known_ransomware_use":false,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-426"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2012-1854"},{"cve_id":"CVE-2025-60710","vendor":"Microsoft","product":"Windows","vulnerability_name":"Microsoft Windows Link Following Vulnerability","date_added":"2026-04-13","due_date":"2026-04-27","days_since_added":157,"days_until_due":-143,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-59"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2025-60710"},{"cve_id":"CVE-2023-21529","vendor":"Microsoft","product":"Exchange Server","vulnerability_name":"Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability","date_added":"2026-04-13","due_date":"2026-04-27","days_since_added":157,"days_until_due":-143,"past_due":true,"known_ransomware_use":true,"required_action":"Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.","cwes":["CWE-502"],"cve_url":"https://www.cve.org/CVERecord?id=CVE-2023-21529"}],"note":"Day-counts are computed from the federal remediation deadline CISA sets for agencies; they are a severity/urgency signal for everyone else, not an obligation.","source":"CISA Known Exploited Vulnerabilities catalog","disclaimer":"Source data from CISA (US federal public domain), retrieved at as_of; groupings and day-counts are computed by AnswerPool. CVE description text is authored by the MITRE CVE Program and is deliberately not redistributed here — follow cve_url for it. Not security advice; KEV inclusion means known exploitation, not that you are exposed.","refresh_after":"2026-09-18T00:00:00.000Z"}