CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

CVE	Vendor	Product	Added	Due
CVE-2026-96951 — Microsoft Windows Command Injection Vulnerability Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.	Microsoft	Windows	Oct 13, 2026	Oct 16, 2026
CVE-2026-65660 — Microsoft SharePoint Code Injection Vulnerability Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.	Microsoft	SharePoint	Sep 25, 2026	Sep 28, 2026
CVE-2026-81963 — Microsoft Windows Link Following Vulnerability Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.	Microsoft	Windows	Sep 8, 2026	Sep 22, 2026
CVE-2026-85880 — Microsoft Windows Heap-Based Buffer Overflow Vulnerability Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.	Microsoft	Windows	Sep 8, 2026	Sep 22, 2026
CVE-2019-1068 — Microsoft SQL Server Remote Code Execution Vulnerability Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.	Microsoft	SQL Server	Aug 26, 2026	Aug 29, 2026
CVE-2026-33824 — Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.	Microsoft	Internet Key Exchange (IKE) Service Extensions	Aug 18, 2026	Aug 21, 2026
CVE-2026-55040 — Microsoft SharePoint Weak Authentication Vulnerability Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.	Microsoft	SharePoint	Aug 18, 2026	Aug 21, 2026
CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.	Microsoft	Windows Ancillary Function Driver for WinSock	Aug 11, 2026	Aug 25, 2026
CVE-2026-50522 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.	Microsoft	SharePoint	Jul 22, 2026	Jul 25, 2026
CVE-2026-58644 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.	Microsoft	SharePoint	Jul 16, 2026	Jul 19, 2026

Microsoft

CVE-2026-96951 — Microsoft Windows Command Injection Vulnerability

Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.

Windows · Oct 13, 2026

Microsoft

CVE-2026-65660 — Microsoft SharePoint Code Injection Vulnerability

Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.

SharePoint · Sep 25, 2026

Microsoft

CVE-2026-81963 — Microsoft Windows Link Following Vulnerability

Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.

Windows · Sep 8, 2026

Microsoft

CVE-2026-85880 — Microsoft Windows Heap-Based Buffer Overflow Vulnerability

Microsoft Windows Advanced Local Procedure Call contains a heap-based buffer overflow vulnerability that allows an attacker to elevate privileges locally.

Windows · Sep 8, 2026

Microsoft

CVE-2019-1068 — Microsoft SQL Server Remote Code Execution Vulnerability

Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.

SQL Server · Aug 26, 2026

Microsoft

CVE-2026-33824 — Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability

Microsoft Internet Key Exchange (IKE) Service Extensions contains a double free vulnerability that could enable remote code execution.

Internet Key Exchange (IKE) Service Extensions · Aug 18, 2026

Microsoft

CVE-2026-55040 — Microsoft SharePoint Weak Authentication Vulnerability

Microsoft SharePoint contains a weak authentication vulnerability which allows an unauthorized attacker to bypass a security feature over a network.

SharePoint · Aug 18, 2026

Microsoft

CVE-2026-68820 — Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability

Microsoft Windows Ancillary Function Driver for WinSock contains a use-after-free vulnerability that allows an authorized attacker to elevate privileges locally.

Windows Ancillary Function Driver for WinSock · Aug 11, 2026

Microsoft

CVE-2026-50522 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft SharePoint contains a deserialization of untrusted data vulnerability which could allow an unauthorized attacker to execute code over a network.

SharePoint · Jul 22, 2026

Microsoft

CVE-2026-58644 — Microsoft SharePoint Deserialization of Untrusted Data Vulnerability

Microsoft SharePoint contains a deserialization of untrusted data vulnerability that allows an unauthorized attacker to execute code over a network.

SharePoint · Jul 16, 2026