CISA Known Exploited Vulnerabilities Directory

Explore every threat in the CISA Known Exploited Vulnerabilities (KEV) catalog, enhanced with plain-English executive analysis, AWS relevance, and technical remediation guidance.

CVE	Vendor	Product	Added	Due	Status
CVE-2022-22047 — Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.	Microsoft	Windows	Jul 12, 2022	Aug 2, 2022
CVE-2022-26925 — Microsoft Windows LSA Spoofing Vulnerability Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.	Microsoft	Windows	Jul 1, 2022	Jul 22, 2022
CVE-2022-30190 — Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.	Microsoft	Windows	Jun 14, 2022	Jul 5, 2022	Ransomware
CVE-2012-0151 — Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.	Microsoft	Windows	Jun 8, 2022	Jun 22, 2022
CVE-2014-4148 — Microsoft Windows Remote Code Execution Vulnerability A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.	Microsoft	Windows	May 25, 2022	Jun 15, 2022
CVE-2015-0016 — Microsoft Windows TS WebProxy Directory Traversal Vulnerability Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges.	Microsoft	Windows	May 25, 2022	Jun 15, 2022
CVE-2015-1671 — Microsoft Windows Remote Code Execution Vulnerability A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.	Microsoft	Windows	May 25, 2022	Jun 15, 2022
CVE-2015-1769 — Microsoft Windows Mount Manager Privilege Escalation Vulnerability A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links.	Microsoft	Windows	May 25, 2022	Jun 15, 2022
CVE-2015-6175 — Microsoft Windows Kernel Privilege Escalation Vulnerability The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application.	Microsoft	Windows	May 25, 2022	Jun 15, 2022
CVE-2016-3393 — Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.	Microsoft	Windows	May 25, 2022	Jun 15, 2022

Microsoft

CVE-2022-22047 — Microsoft Windows Client Server Runtime Subsystem (CSRSS) Privilege Escalation Vulnerability

Microsoft Windows CSRSS contains an unspecified vulnerability that allows for privilege escalation to SYSTEM privileges.

Windows · Jul 12, 2022

Microsoft

CVE-2022-26925 — Microsoft Windows LSA Spoofing Vulnerability

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.

Windows · Jul 1, 2022

Ransomware Microsoft

CVE-2022-30190 — Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run code with the privileges of the calling application.

Windows · Jun 14, 2022

Microsoft

CVE-2012-0151 — Microsoft Windows Authenticode Signature Verification Remote Code Execution Vulnerability

The Authenticode Signature Verification function in Microsoft Windows (WinVerifyTrust) does not properly validate the digest of a signed portable executable (PE) file, which allows user-assisted remote attackers to execute code.

Windows · Jun 8, 2022

Microsoft

CVE-2014-4148 — Microsoft Windows Remote Code Execution Vulnerability

A remote code execution vulnerability exists when the Windows kernel-mode driver improperly handles TrueType fonts.

Windows · May 25, 2022

Microsoft

CVE-2015-0016 — Microsoft Windows TS WebProxy Directory Traversal Vulnerability

Directory traversal vulnerability in the TS WebProxy (TSWbPrxy) component in Microsoft Windows allows remote attackers to escalate privileges.

Windows · May 25, 2022

Microsoft

CVE-2015-1671 — Microsoft Windows Remote Code Execution Vulnerability

A remote code execution vulnerability exists when components of Windows, .NET Framework, Office, Lync, and Silverlight fail to properly handle TrueType fonts.

Windows · May 25, 2022

Microsoft

CVE-2015-1769 — Microsoft Windows Mount Manager Privilege Escalation Vulnerability

A privilege escalation vulnerability exists when the Windows Mount Manager component improperly processes symbolic links.

Windows · May 25, 2022

Microsoft

CVE-2015-6175 — Microsoft Windows Kernel Privilege Escalation Vulnerability

The kernel in Microsoft Windows contains a vulnerability that allows local users to gain privileges via a crafted application.

Windows · May 25, 2022

Microsoft

CVE-2016-3393 — Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability

A remote code execution vulnerability exists due to the way the Windows GDI component handles objects in the memory. An attacker who successfully exploits this vulnerability could take control of the affected system.

Windows · May 25, 2022