Known Exploited Vulnerabilities: Live

Breadth

Exploited in the wild, not yet on CISA's list.

VulnCheck tracks 532 additional SMB-relevant CVEs being actively exploited beyond CISA's KEV catalog. 52 are flagged as used in ransomware campaigns. The list below covers the same vendors as everything else on this page: Microsoft, Apple, Adobe, Cisco, Fortinet, SonicWall, Ivanti, Palo Alto, Google, and Ubiquiti.

CVE-2020-17103VulnCheck
· Microsoft Windows
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
VulnCheck recorded exploitation activity as of Jul 10, 2026
CVE-2026-45586VulnCheck
· Microsoft Windows
Microsoft Windows Improper Link Resolution Before File Access ('Link Following')
VulnCheck recorded exploitation activity as of Jul 10, 2026
CVE-2021-27076VulnCheck
· Microsoft Business Productivity Servers
Microsoft SharePoint Server Remote Code Execution Vulnerability
VulnCheck recorded exploitation activity as of Jun 24, 2026
CVE-2026-39813VulnCheck
· Fortinet FortiSandbox
Fortinet FortiSandbox Path Traversal: '../filedir'
VulnCheck recorded exploitation activity as of Jun 15, 2026
CVE-2026-41089VulnCheck
· Microsoft Windows
Microsoft Windows Stack-based Buffer Overflow
VulnCheck recorded exploitation activity as of May 29, 2026
CVE-2024-12802VulnCheckKnown ransomware use
· SonicWall SonicOS
SonicWall SonicOS Authentication Bypass by Primary Weakness
VulnCheck recorded exploitation activity as of May 19, 2026
CVE-2025-40601VulnCheck
· SonicWall SonicOS
SonicWall SonicOS Stack-based Buffer Overflow
VulnCheck recorded exploitation activity as of May 10, 2026
CVE-2025-40600VulnCheck
· SonicWall SonicOS
SonicWall SonicOS Use of Externally-Controlled Format String
VulnCheck recorded exploitation activity as of May 10, 2026
CVE-2025-32818VulnCheck
· SonicWall SonicOS
SonicWall SonicOS NULL Pointer Dereference
VulnCheck recorded exploitation activity as of May 10, 2026
CVE-2026-25187VulnCheck
· Microsoft Windows
Microsoft Windows Improper Link Resolution Before File Access ('Link Following')
VulnCheck recorded exploitation activity as of Apr 13, 2026

Show all 532 SMB-relevant (522 more)

CVE-2026-21262VulnCheck
· Microsoft SQL Server 2016
Microsoft SQL Server 2016 Improper Access Control
VulnCheck recorded exploitation activity as of Apr 13, 2026
CVE-2026-26127VulnCheck
· Microsoft .NET
Microsoft .NET Out-of-bounds Read
VulnCheck recorded exploitation activity as of Apr 13, 2026
CVE-2025-43542VulnCheck
· Apple macOS
Apple iOS/iPadOS/visionOS and macOS Sequoia/Tahoe FaceTime Password Disclosure
VulnCheck recorded exploitation activity as of Apr 7, 2026
CVE-2025-43532VulnCheck
· Apple macOS
Apple macOS Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
VulnCheck recorded exploitation activity as of Apr 7, 2026
CVE-2025-43517VulnCheck
· Apple macOS
Apple macOS Sequoia/Sonoma/Tahoe Log Entry Data Redaction Vulnerability
VulnCheck recorded exploitation activity as of Apr 7, 2026
CVE-2025-46289VulnCheck
· Apple macOS
Apple macOS Improper Authorization
VulnCheck recorded exploitation activity as of Apr 7, 2026
CVE-2025-24113VulnCheck
· Apple Safari
Apple Safari/iOS/iPadOS/visionOS/watchOS and macOS Sequoia Interface Spoofing Vulnerability

VulnCheck also tracks 2,860 exploited CVEs outside the SMB-relevant vendor allowlist — gear we don't typically see in dental, law, or accounting shops. Full exploited-not-on-CISA breadth: 3,392.

Breadth data via VulnCheck KEV.

Last 90 days

Added recently.

New SMB-relevant additions to KEV in the last 90 days — the urgent items most likely to need action this quarter.

CVE-2026-58644 · Microsoft SharePointDeserialization of Untrusted Data VulnerabilityPatch this weekAdded to KEV Jul 16, 2026
Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
Affects anyone running Microsoft SharePoint. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.
View the full entry
Fortinet FortiSandbox: 2 CVEsPatch this weekadded Jul 16, 2026
- CVE-2026-25089
  Fortinet FortiSandbox OS Command Injection Vulnerability
  Affects anyone whose internet connection goes through a Fortinet appliance — typically a FortiGate firewall or FortiClient VPN. The firewall sits between every device in the office and the internet; exploitation can mean an attacker gets inside the network perimeter without touching a workstation.
  Fortinet FortiSandbox, FortiSandbox Cloud, and FortiSandbox PaaS contain an OS command injection vulnerability that allows an unauthenticated attacker to execute unauthorized commands via specifically crafted HTTP requests.
- CVE-2026-39808
  Fortinet FortiSandbox OS Command Injection Vulnerability
  Affects anyone whose internet connection goes through a Fortinet appliance — typically a FortiGate firewall or FortiClient VPN. The firewall sits between every device in the office and the internet; exploitation can mean an attacker gets inside the network perimeter without touching a workstation.
  Fortinet FortiSandbox contains an OS command injection vulnerability that could allow an unauthenticated attacker to execute unauthorized code or commands via crafted HTTP requests.
SonicWall SMA1000 Appliances: 2 CVEsPatch this weekadded Jul 14, 2026
- CVE-2026-15410
  SonicWall SMA1000 Appliances Code Injection Vulnerability
  Affects anyone whose network is fronted by a SonicWall firewall or SSL VPN. The device sits at the edge between your office and the internet and authenticates remote workers — exploitation typically means an attacker reaches inside without needing a user credential.
  SonicWall SMA1000 Appliances contain a code injection vulnerability which in specific conditions could potentially enable a remote authenticated attacker as administrator to execute arbitrary OS commands.
- CVE-2026-15409
  SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
  Affects anyone whose network is fronted by a SonicWall firewall or SSL VPN. The device sits at the edge between your office and the internet and authenticates remote workers — exploitation typically means an attacker reaches inside without needing a user credential.
  SonicWall SMA1000 Appliances contain a server-side request forgery vulnerability that could allow a remote unauthenticated attacker to potentially cause the appliance to make requests to unintended location.
CVE-2026-56155 · Microsoft Active Directory Federation ServicesInsufficient Granularity of Access Control VulnerabilityPlan to patchAdded to KEV Jul 14, 2026
Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability
Affects anyone running Microsoft Active Directory Federation Services. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft Active Directory Federation Services contains an insufficient granularity of access control vulnerability that allows an authorized attacker to elevate privileges locally.
View the full entry
CVE-2026-56164 · Microsoft SharePoint ServerMissing Authentication for Critical Function VulnerabilityMonitorAdded to KEV Jul 14, 2026
Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability
Affects anyone running Microsoft SharePoint Server. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft SharePoint contains a missing authentication for critical function vulnerability that allows an unauthorized attacker to elevate privileges over a network.
View the full entry
CVE-2008-4128 · Cisco iOSCross-Site Request Forgery VulnerabilityPlan to patchAdded to KEV Jul 13, 2026
Cisco iOS Cross-Site Request Forgery Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco IOS 12.4 contains multiple cross-site forgery vulnerabilities that allows remote attackers to execute arbitrary commands via (1) a certain "show privilege" command to the /level/15/exec/- URI, and (2) a certain "alias exec" command to the /level/15/exec/-/configure/http URI.
View the full entry
CVE-2026-48282 · Adobe ColdFusionPath Traversal VulnerabilityPatch this weekAdded to KEV Jul 7, 2026
Adobe ColdFusion Path Traversal Vulnerability
Affects anyone running Adobe ColdFusion. If it's part of your document workflow, exploitation can lead to code execution when a user opens an attacker-controlled file.
Adobe ColdFusion contains a path traversal vulnerability that could lead to arbitrary code execution in the context of the current user.
View the full entry
CVE-2026-45659 · Microsoft SharePoint ServerDeserialization of Untrusted Data VulnerabilityPlan to patchAdded to KEV Jul 1, 2026
Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability
Affects anyone running Microsoft SharePoint Server. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft SharePoint Server contains a deserialization of untrusted data vulnerability which allows an authorized attacker to execute code over a network.
View the full entry
CVE-2026-20230 · Cisco Unified Communications ManagerServer-Side Request Forgery (SSRF) VulnerabilityPatch this weekAdded to KEV Jun 25, 2026
Cisco Unified Communications Manager Server-Side Request Forgery (SSRF) Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco Unified Communications Manager (Unified CM) and Cisco Unified Communications Manager Session Management Edition (Unified CM SME) contain a server-side request forgery (SSRF) Vulnerability that could allow an unauthenticated, remote attacker to write files to the underlying operating system that could be used later to elevate to root.
View the full entry
Ubiquiti UniFi OS: 3 CVEsPatch this weekadded Jun 23, 2026
- CVE-2026-34910
  Ubiquiti UniFi OS Improper Input Validation Vulnerability
  Affects anyone running Ubiquiti UniFi networking gear (access points, switches, security gateways, NVRs). The gear carries internal network traffic and often hosts video surveillance — exploitation can expose network traffic or grant management access to the network itself.
  Ubiquiti UniFi OS contains an improper input validation vulnerability which could allow a malicious actor with access to the network to conduct command injection.
- CVE-2026-34909
  Ubiquiti UniFi OS Path Traversal Vulnerability
  Affects anyone running Ubiquiti UniFi networking gear (access points, switches, security gateways, NVRs). The gear carries internal network traffic and often hosts video surveillance — exploitation can expose network traffic or grant management access to the network itself.
  Ubiquiti UniFi OS contains a path traversal vulnerability which could allow a malicious actor with access to the network to access files on the underlying system that could be manipulated to access an underlying account.
- CVE-2026-34908
  Ubiquiti UniFi OS Improper Access Control Vulnerability
  Affects anyone running Ubiquiti UniFi networking gear (access points, switches, security gateways, NVRs). The gear carries internal network traffic and often hosts video surveillance — exploitation can expose network traffic or grant management access to the network itself.
  Ubiquiti UniFi OS contains an improper access control vulnerability which could allow a malicious actor with access to the network to make unauthorized changes to the system.
CVE-2026-20262 · Cisco Catalyst SD-WAN ManagerDirectory or Path Traversal VulnerabilityPlan to patchAdded to KEV Jun 15, 2026
Cisco Catalyst SD-WAN Manager Directory or Path Traversal Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco Catalyst SD-WAN Manager contains a directory or path traversal vulnerability that could allow an authenticated, remote attacker to create a file or overwrite any file on the filesystem of an affected system.
View the full entry
CVE-2026-10520 · Ivanti SentryOS Command Injection VulnerabilityPatch this weekAdded to KEV Jun 11, 2026
Ivanti Sentry OS Command Injection Vulnerability
Affects anyone using Ivanti VPN (Connect Secure or Pulse) or Ivanti endpoint management. The VPN is what remote workers use to reach internal systems; the endpoint management tool typically has admin reach into every laptop — exploitation in either is high-impact.
Ivanti Sentry (formerly known as MobileIron Sentry) contains an OS command injection vulnerability which could allow a remote unauthenticated user to achieve root-level remote code execution. This vulnerability can be successfully exploited in cases where the Sentry appliance is in an unmanaged state with its endpoints externally reachable. The use of mTLS with EPMM or restricted HTTPS access through Neurons for MDM makes interfaces inaccessible to external actors.
View the full entry
CVE-2026-11645 · Google Chromium V8Out-of-Bounds Read and Write VulnerabilityPlan to patchAdded to KEV Jun 9, 2026
Google Chromium V8 Out-of-Bounds Read and Write Vulnerability
Affects anyone using Chrome or Chromium as their browser. The browser is where staff log into cloud apps, banking, and client portals — exploitation can mean session theft or credential exposure for every site you're signed into.
Google Chromium V8 out-of-bounds read and write vulnerability that could allow a remote attacker to execute arbitrary code inside a sandbox via a crafted HTML page. This vulnerability could affect multiple web browsers that utilize Chromium, including, but not limited to, Google Chrome, Microsoft Edge, and Opera.
View the full entry
CVE-2026-20245 · Cisco Catalyst SD-WAN ManagerImproper Encoding or Escaping of Output VulnerabilityPatch this weekAdded to KEV Jun 9, 2026
Cisco Catalyst SD-WAN Manager Improper Encoding or Escaping of Output Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco Catalyst SD-WAN Manager formerly SD-WAN vManage contains an improper encoding or escaping of output vulnerability. This vulnerability could allow an authenticated, local attacker to execute arbitrary commands as root by supplying a crafted file to the affected system.
View the full entry
CVE-2026-0257 · Palo Alto Networks PAN-OSAuthentication Bypass VulnerabilityPatch this weekAdded to KEV May 29, 2026
Palo Alto Networks PAN-OS Authentication Bypass Vulnerability
Affects anyone behind a Palo Alto firewall or using GlobalProtect VPN. The firewall is the network edge; the VPN is how remote workers reach inside the perimeter — exploitation puts an attacker on the internal network without touching a workstation.
Palo Alto Networks PAN-OS contains an authentication bypass vulnerability that allows attackers to bypass security restrictions and establish an unauthorized VPN connection.
View the full entry
CVE-2009-3459 · Adobe Acrobat and ReaderHeap-Based Buffer Overflow VulnerabilityPlan to patchAdded to KEV May 20, 2026
Adobe Acrobat and Reader Heap-Based Buffer Overflow Vulnerability
Affects anyone opening, editing, or signing PDFs in Adobe Acrobat or Reader. For a CPA or legal practice, PDFs are typically client tax returns, engagement letters, signed agreements, and discovery documents — opening a malicious PDF runs attacker code in the user's session, which can pivot to file shares or email.
Adobe Acrobat and Reader contain a heap-based buffer overflow vulnerability which could allow remote attackers to execute arbitrary code via a crafted PDF file that triggers memory corruption.
View the full entry
Microsoft Defender: 2 CVEsPlan to patchadded May 20, 2026
- CVE-2026-41091
  Microsoft Defender Link Following Vulnerability
  Affects anyone running Microsoft Defender. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
  Microsoft Defender contains a link following vulnerability that allows an authorized attacker to elevate privileges locally.
- CVE-2026-45498
  Microsoft Defender Denial of Service Vulnerability
  Affects anyone running Microsoft Defender. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
  Microsoft Defender contains an unspecified vulnerability that allows for denial of service.
CVE-2008-4250 · Microsoft WindowsBuffer Overflow VulnerabilityPatch this weekAdded to KEV May 20, 2026
Microsoft Windows Buffer Overflow Vulnerability
Affects anyone running Windows workstations or servers. In a small CPA, legal, or dental practice, Windows is typically the platform your accounting, document management, or practice management software runs on — exploitation gives an attacker access to whatever client files and credentials live on those machines.
Microsoft Windows contains a buffer overflow vulnerability in the Windows Server Service that allows remote attackers to execute arbitrary code via a crafted RPC request that triggers an overflow during path canonicalization.
View the full entry
CVE-2009-1537 · Microsoft DirectXNULL Byte Overwrite VulnerabilityPlan to patchAdded to KEV May 20, 2026
Microsoft DirectX NULL Byte Overwrite Vulnerability
Affects anyone running Microsoft DirectX. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft DirectX contains a NULL byte overwrite vulnerability in the QuickTime Movie Parser Filter in quartz.dll in DirectShow which could allow remote attackers to execute arbitrary code via a crafted QuickTime media file.
View the full entry
Microsoft Internet Explorer: 2 CVEsPlan to patchadded May 20, 2026
- CVE-2010-0249
  Microsoft Internet Explorer Use-After-Free Vulnerability
  Affects anyone running Microsoft Internet Explorer. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
  Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code by accessing a pointer associated with a deleted object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
- CVE-2010-0806
  Microsoft Internet Explorer Use-After-Free Vulnerability
  Affects anyone running Microsoft Internet Explorer. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
  Microsoft Internet Explorer contains an use-after-free vulnerability that could allow remote attackers to execute arbitrary code via vectors involving access to an invalid pointer after the deletion of an object. The impacted product could be end-of-life (EoL) and/or end-of-service (EoS). Users should discontinue product utilization.
CVE-2026-42897 · Microsoft Exchange ServerExchange Server Cross-Site Scripting VulnerabilityPlan to patchAdded to KEV May 15, 2026
Microsoft Exchange Server Cross-Site Scripting Vulnerability
Affects anyone running on-premises Microsoft Exchange Server. If you have Exchange in your office (as opposed to Microsoft 365 hosted email), it's the mail server holding all internal email — full compromise reads every conversation it stores.
Microsoft Exchange Server contains a cross-site scripting vulnerability during web page generation in Outlook Web Access and when certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
- KB5094144
- KB5094142
- KB5094140
- KB5094139
View the full entry
CVE-2026-20182 · Cisco Catalyst SD-WANController Authentication Bypass VulnerabilityPatch this weekAdded to KEV May 14, 2026
Cisco Catalyst SD-WAN Controller Authentication Bypass Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco Catalyst SD-WAN Controller & Manager contain an authentication bypass vulnerability that allows an unauthenticated, remote attacker to bypass authentication and obtain administrative privileges on an affected system.
View the full entry
CVE-2026-6973 · Ivanti Endpoint Manager Mobile (EPMM)Improper Input Validation VulnerabilityPatch this weekAdded to KEV May 7, 2026
Ivanti Endpoint Manager Mobile (EPMM) Improper Input Validation Vulnerability
Affects anyone using Ivanti VPN (Connect Secure or Pulse) or Ivanti endpoint management. The VPN is what remote workers use to reach internal systems; the endpoint management tool typically has admin reach into every laptop — exploitation in either is high-impact.
Ivanti Endpoint Manager Mobile (EPMM) contains an improper input validation vulnerability that allows a remotely authenticated user with administrative access to achieve remote code execution.
View the full entry
CVE-2026-0300 · Palo Alto Networks PAN-OSOut-of-bounds Write VulnerabilityPatch this weekAdded to KEV May 6, 2026
Palo Alto Networks PAN-OS Out-of-bounds Write Vulnerability
Affects anyone behind a Palo Alto firewall or using GlobalProtect VPN. The firewall is the network edge; the VPN is how remote workers reach inside the perimeter — exploitation puts an attacker on the internal network without touching a workstation.
Palo Alto Networks PAN-OS contains an out-of-bounds write vulnerability in the User-ID Authentication Portal (aka Captive Portal) service that can allow an unauthenticated attacker to execute arbitrary code with root privileges on the PA-Series and VM-Series firewalls by sending specially crafted packets.
View the full entry
CVE-2026-32202 · Microsoft WindowsProtection Mechanism Failure VulnerabilityMonitorAdded to KEV Apr 28, 2026
Microsoft Windows Protection Mechanism Failure Vulnerability
Affects anyone running Windows workstations or servers. In a small CPA, legal, or dental practice, Windows is typically the platform your accounting, document management, or practice management software runs on — exploitation gives an attacker access to whatever client files and credentials live on those machines.
Microsoft Windows Shell contains a protection mechanism failure vulnerability that allows an unauthorized attacker to perform spoofing over a network.
- KB5082123
- KB5082142
- KB5082200
- KB5082063
- +7 more
View the full entry
CVE-2026-33825 · Microsoft DefenderInsufficient Granularity of Access Control VulnerabilityKnown ransomware usePatch nowAdded to KEV Apr 22, 2026
Microsoft Defender Insufficient Granularity of Access Control Vulnerability
Affects anyone running Microsoft Defender. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft Defender contains an insufficient granularity of access control vulnerability that could allow an authorized attacker to escalate privileges locally.
View the full entry
Cisco Catalyst SD-WAN Manager: 2 CVEsPatch this weekadded Apr 20, 2026
- CVE-2026-20128
  Cisco Catalyst SD-WAN Manager Storing Passwords in a Recoverable Format Vulnerability
  Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
  Cisco Catalyst SD-WAN Manager contains a storing passwords in a recoverable format vulnerability that allows an authenticated, local attacker to gain DCA user privileges by accessing a credential file for the DCA user on the filesystem as a low-privileged user.
- CVE-2026-20133
  Cisco Catalyst SD-WAN Manager Exposure of Sensitive Information to an Unauthorized Actor Vulnerability
  Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
  Cisco Catalyst SD-WAN Manager contains an exposure of sensitive information to an unauthorized actor vulnerability that could allow remote attackers to view sensitive information on affected systems.
CVE-2026-20122 · Cisco Catalyst SD-WAN ManagerCatalyst SD-WAN Manager Incorrect Use of Privileged APIs VulnerabilityPlan to patchAdded to KEV Apr 20, 2026
Cisco Catalyst SD-WAN Manager Incorrect Use of Privileged APIs Vulnerability
Affects anyone with Cisco networking or security appliances on their network — typically a firewall, switch, or remote-access VPN. That device controls traffic to and from every workstation; exploitation can mean an attacker pivots inside the network without touching any user device.
Cisco Catalyst SD-WAN Manager contains an incorrect use of privileged APIs vulnerability due to improper file handling on the API interface of an affected system. An attacker could exploit this vulnerability by uploading a malicious file on the local file system. A successful exploit could allow the attacker to overwrite arbitrary files on the affected system and gain vmanage user privileges.
View the full entry

Earlier

Older entries still worth a check.

The most recent SMB-relevant entries that predate the 90-day window above. Use the search bar to reach anything older.

CVE-2009-0238 · Microsoft OfficeRemote Code ExecutionPlan to patchAdded to KEV Apr 14, 2026
Microsoft Office Remote Code Execution
Affects anyone using Microsoft 365 or Office to compose, store, or send email, documents, or spreadsheets. In a small practice, that's typically where client communications, engagement letters, and case notes live — credential compromise here means an attacker reads everything that platform stores.
Microsoft Office Excel contains a remote code execution vulnerability that could allow an attacker to take complete control of an affected system if a user opens a specially crafted Excel file that includes a malformed object.
View the full entry
CVE-2026-32201 · Microsoft SharePoint ServerImproper Input Validation VulnerabilityMonitorAdded to KEV Apr 14, 2026
Microsoft SharePoint Server Improper Input Validation Vulnerability
Affects anyone running Microsoft SharePoint Server. Microsoft products in a small practice typically sit close to credentials, email, or document workflows — treat the patch as in-scope.
Microsoft SharePoint Server contains an improper input validation vulnerability that allows an unauthorized attacker to perform spoofing over a network.
- KB5002861

5 new fixes landed this week.

What to patch first.

One Windows Update run clears all of these.

Get this list in your inbox.

You don't have to triage 819 vulnerabilities yourself.

What's being actively exploited.

Exploited in the wild, not yet on CISA's list.

Added recently.

Older entries still worth a check.