Microsoft
- Exploited flaws
- 390in 72 products
- Added to CISA's list in 2026
- 4039 in 2025
- Used by ransomware
- 117of 390, says CISA
- Disclosure to CISA's list
- 860 daysmedian; 105 of 303 listed within 30 days
Exploited flaws by the year they were disclosed
The year in each CVE ID, roughly when the flaw became public. Recent years can still grow: flaws are often exploited, and listed, years later.
Hover or tab through a year for its count.
Show as a table
| Year disclosed | Exploited flaws |
|---|---|
| 2002 | 1 |
| 2003 | 0 |
| 2004 | 1 |
| 2005 | 0 |
| 2006 | 1 |
| 2007 | 1 |
| 2008 | 2 |
| 2009 | 7 |
| 2010 | 8 |
| 2011 | 3 |
| 2012 | 8 |
| 2013 | 14 |
| 2014 | 13 |
| 2015 | 19 |
| 2016 | 20 |
| 2017 | 29 |
| 2018 | 16 |
| 2019 | 33 |
| 2020 | 24 |
| 2021 | 49 |
| 2022 | 24 |
| 2023 | 28 |
| 2024 | 32 |
| 2025 | 30 |
| 2026 | 27 |
Products exploited more than once
| Product | Flaws | First listed | Latest |
|---|---|---|---|
| Windows | 173 | 2021-11-03 | 2026-10-13 |
| Internet Explorer | 36 | 2021-11-03 | 2026-05-20 |
| Office | 29 | 2021-11-03 | 2026-04-14 |
| Win32k | 25 | 2021-11-03 | 2023-06-22 |
| Exchange Server | 17 | 2021-11-03 | 2026-04-13 |
| SharePoint | 10 | 2021-11-03 | 2026-09-25 |
| Defender | 5 | 2021-11-03 | 2026-05-20 |
| SharePoint Server | 5 | 2024-01-10 | 2026-07-14 |
| Open Management Infrastructure (OMI) | 4 | 2021-11-03 | 2021-11-03 |
| Word | 4 | 2022-02-15 | 2023-09-12 |
| .NET Framework | 3 | 2021-11-03 | 2025-02-04 |
| Active Directory | 3 | 2022-04-11 | 2022-08-18 |
| Excel | 3 | 2022-03-03 | 2022-03-03 |
| Silverlight | 3 | 2022-05-25 | 2022-05-25 |
| DirectX Graphics Kernel (DXGKRNL) | 2 | 2022-03-28 | 2022-03-28 |
And 11 more.
Latest on CISA's list
- Microsoft Windows Command Injection Vulnerability
- Microsoft SharePoint Code Injection Vulnerability
- Microsoft Windows Heap-Based Buffer Overflow Vulnerability
- Microsoft Windows Link Following Vulnerability
- Microsoft SQL Server Remote Code Execution Vulnerability
- Microsoft SharePoint Weak Authentication Vulnerability
- Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability
- Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability
- Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
- Microsoft SharePoint Deserialization of Untrusted Data Vulnerability
In the news
- Microsoft releases Windows OOB updates to distrust eMudhra certificates
- Microsoft Edge (Chromium-based): security feature bypass flaw
- Microsoft Edge (Chromium-based): remote code execution flaw
- Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens
- Attackers Use Microsoft Teams IT Support Scams to Deploy Malware and Ransomware
- Microsoft releases emergency .NET patches for critical Brotli flaw
- Microsoft PowerShell: security feature bypass flaw
- Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations
From CISA's Known Exploited Vulnerabilities catalogue. "Disclosure to CISA's list" uses NVD's publication date and leaves out the 2021-11-03 launch, when CISA added hundreds of older flaws at once; CISA often lists a flaw after attacks have begun, so it's an upper limit on how fast exploitation came.