Consulta vulnerabilidades CVE, conoce su impacto y verifica las medidas de corrección en fuentes oficiales.
CVE
Riesgo
KB asociado
Descripcion del KB
Fecha de liberacion
CVE-2026-41096
Critical
KB5087541
5087541
12/05/2026
CVE-2026-41096
Critical
KB5089548
5089548
12/05/2026
CVE-2026-41103
Critical
N/D
Incorrect implementation of authentication algorithm in Microsoft SSO Plugin for Jira & Confluence allows an unauthorized attacker to elevate privileges over a network. What privileges could be gained by an attacker who successfully exploited this vulnerability?
An attacker who successfully exploited this vulnerability could bypass authentication and gain unauthorized access to Jira or Confluence as a valid user. This may allow the attacker to view or modify content and perform actions with the same permissions as the compromised account, based on the authorization levels defined for that user within the Jira or Confluence server. How could an attacker exploit the vulnerability?
An attacker could exploit this vulnerability by sending a specially crafted SSO response during the login process that tricks the system into accepting a forged identity, allowing the attacker to sign in without authenticating the user through Microsoft Entra ID. According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), and integrity (I:H), but could lead to no loss of availability (A:N). What does that mean for this vulnerability?
This means that an attacker who successfully exploits the vulnerability could access sensitive information and modify data within Jira or Confluence based on the authorization defined for the user in those servers but availability is not impacted because the vulnerability only allows an attacker to bypass authentication and act as a legitimate user, without providing any capability to disrupt, degrade, or take down the Jira or Confluence service itself.
12/05/2026
CVE-2026-41104
Critical
N/D
Deserialization of untrusted data in Microsoft Planetary Computer Pro allows an unauthorized attacker to disclose information over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-41105
Critical
N/D
Server-side request forgery (ssrf) in Azure Notification Service allows an authorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-41615
Critical
N/D
Exposure of sensitive information to an unauthorized actor in Microsoft Authenticator allows an unauthorized attacker to disclose information over a network. According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities. What type of information could be disclosed by this vulnerability?
This vulnerability could expose a sign-in access token for a user’s work account. If disclosed, that token could allow access to data and services that the user is authorized to use, potentially including sensitive organizational information. How could an attacker exploit this vulnerability?
An attacker could attempt to trick a user into interacting with a malicious request that appears legitimate. When the user approves the request, the attacker could cause the app to obtain an access token on the user’s behalf and send it to a location controlled by the attacker, without the user being clearly informed about what access is being granted. Do users need to take any action to receive the fix for the Authenticator app issue on Android?
Users who have automatic app updates enabled on their Android device will receive the fix without any action required. Users who do not have auto-update enabled must manually update the Microsoft Authenticator app to the latest version via the Google Play Store to ensure they receive the fix.
12/05/2026
CVE-2026-42822
Critical
N/D
Improper authentication in Azure Local Disconnected Operations allows an unauthorized attacker to elevate privileges over a network. How do I protect myself from this vulnerability?
For Azure Local Disconnected Operations (ALDO) customers:
To protect against this vulnerability, customers must update their Azure Local Disconnected Operations (ALDO) environment to the latest available release (version 2604 or later). Updates are not available as standalone patches and must be applied as a full system update through the Azure portal. ALDO is a restricted offering, and updates are only available to approved customers via allow-listing.
Customers should follow Microsoft guidance to obtain access and apply the update, using the following documentation:
How to deploy Disconnected Operations for Azure Local
How to update Disconnected Operations for Azure Local According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities. What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker could gain elevated privileges beyond those normally available to them, allowing actions such as accessing restricted information or performing operations that are typically limited to more highly privileged users or administrators. How could an attacker exploit this vulnerability?
The most realistic exploitation scenario involves a malicious or compromised insider with existing access to the customer’s environment.
An attacker could exploit this vulnerability if they:
Already have access to the internal environment (e.g., an internal user, contractor, or compromised account).
Possess or can obtain relevant identity information such as tenant identifiers, user identifiers, credentials, or tokens.
Use this access to interact with and attempt exploitation within the Azure Local Disconnected Operations (ALDO) environment.
Because an insider or compromised internal identity already satisfies many of the environmental and authentication requirements, they may bypass several of the barriers that would otherwise make exploitation more difficult.
In external attacker scenarios, exploitation is significantly more constrained. An attacker would first need to:
Gain access to the customer’s internal network (which may require physical presence or prior compromise), and
Obtain valid identity context within the environment.
Additionally, Azure Local Disconnected Operations is designed to operate in a disconnected and isolated configuration, limiting direct external exposure and reducing the likelihood of opportunistic remote exploitation.
12/05/2026
CVE-2026-42826
Critical
N/D
Exposure of sensitive information to an unauthorized actor in Azure DevOps allows an unauthorized attacker to disclose information over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-42827
Critical
N/D
Improper neutralization of special elements used in a command ('command injection') in M365 Copilot allows an unauthorized attacker to disclose information over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-42831
Critical
N/D
Heap-based buffer overflow in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send a user a malicious Office file and convince them to open it. Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
12/05/2026
CVE-2026-42897
Critical
N/D
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. How could an attacker exploit this vulnerability?
An attacker could exploit this issue by sending a specially crafted email to a user. If the user opens the email in Outlook Web Access and certain interaction conditions are met, arbitrary JavaScript can be executed in the browser context.
How do I protect my Exchange Server from this vulnerability?
The Exchange Emergency Mitigation Service will provide mitigation automatically, and is on by default. If it is not already enabled on your Exchange Server, you need to enable Exchange Emergency Mitigation Service. You can find more information and instruction in the Exchange blog here.
Am I protected from this vulnerability if I am running Internet Explorer or Edge with Internet Explorer Mode?
No, because Content Security Policy (CSP) is not supported by Internet Explorer nor Microsoft Edge using Internet Explorer Mode. To stay protected, please make sure to not use Internet Explorer (Mode) to access OWA.
Update 7/14/2026
Microsoft recommends installing the July 2026 Security Updates for your version of Exchange Server as soon as possible to be protected from this vulnerability and related CVE-2026-55008 vulnerability. Mitigations that have been applied either using the Exchange Emergency Mitigation Service or the EOMT script can be removed after July 2026 update is installed. Please see the Exchange blog post for more information.
12/05/2026
CVE-2026-42898
Critical
N/D
Improper control of generation of code ('code injection') in Microsoft Dynamics 365 (on-premises) allows an authorized attacker to execute code over a network. According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges. According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities. How could an attacker exploit this vulnerability?
An attacker with the required permissions could modify the saved state of a process session in Dynamics CRM and trigger the system to process that data, which could result in the server unintentionally executing malicious code.
12/05/2026
CVE-2026-42901
Critical
N/D
Origin validation error in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-42945
Critical
N/D
N/D
12/05/2026
CVE-2026-45584
Critical
N/D
Heap-based buffer overflow in Microsoft Defender allows an unauthorized attacker to execute code over a network. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment. How could an attacker exploit this vulnerability?
Successful exploitation of this vulnerability would require a remote, unauthenticated attacker to entice a local user to take multiple actions that results in Defender scanning a malicious file that has been quarantined. References
Identification
Last version of the Microsoft Malware Protection Engine affected by this vulnerability
1.1.26030.3008
First version of the Microsoft Malware Protection Engine with this vulnerability addressed
Version 1.1.26040.8
See Manage Updates Baselines Microsoft Defender Antivirus for more information.
Microsoft Defender is disabled in my environment, why are vulnerability scanners showing that I am vulnerable to this issue?
Vulnerability scanners are looking for specific binaries and version numbers on devices. Microsoft Defender files are still on disk even when disabled. Systems that have disabled Microsoft Defender are not in an exploitable state.
Why is no action required to install this update?
In response to a constantly changing threat landscape, Microsoft frequently updates malware definitions and the Microsoft Malware Protection Engine. In order to be effective in helping protect against new and prevalent threats, antimalware software must be kept up to date with these updates in a timely manner.
For enterprise deployments as well as end users, the default configuration in Microsoft antimalware software helps ensure that malware definitions and the Microsoft Malware Protection Engine are kept up to date automatically. Product documentation also recommends that products are configured for automatic updating.
Best practices recommend that customers regularly verify whether software distribution, such as the automatic deployment of Microsoft Malware Protection Engine updates and malware definitions, is working as expected in their environment.
How often are the Microsoft Malware Protection Engine and malware definitions updated?
Microsoft typically releases an update for the Microsoft Malware Protection Engine once a month or as needed to protect against new threats. Microsoft also typically updates the malware definitions three times daily and can increase the frequency when needed.
Depending on which Microsoft antimalware software is used and how it is configured, the software may search for engine and definition updates every day when connected to the Internet, up to multiple times daily. Customers can also choose to manually check for updates at any time.
What is the Microsoft Malware Protection Engine?
The Microsoft Malware Protection Engine, mpengine.dll, provides the scanning, detection, and cleaning capabilities for Microsoft antivirus and antispyware software.
Windows Defender uses the Microsoft Malware Protection Engine. On which products is Defender installed and active by default?
Defender runs on all supported version of Windows.
Are there other products that use the Microsoft Malware Protection Engine?
Yes, Microsoft System Center Endpoint Protection, Microsoft System Center 2012 R2 Endpoint Protection, Microsoft System Center 2012 Endpoint Protection and Microsoft Security Essentials.
Does this update contain any additional security-related changes to functionality?
Yes. In addition to the changes that are listed for this vulnerability, this update includes defense-in-depth updates to help improve security-related features.
12/05/2026
CVE-2026-45899
Critical
N/D
N/D
12/05/2026
CVE-2026-46595
Critical
N/D
N/D
12/05/2026
CVE-2026-47280
Critical
N/D
Improper authentication in Azure Resource Manager (ARM) allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
12/05/2026
CVE-2026-6722
Critical
N/D
N/D
12/05/2026
CVE-2026-7374
Critical
N/D
N/D
12/05/2026
CVE-2026-8450
Critical
N/D
N/D
12/05/2026
CVE-2017-20230
Critical
N/D
N/D
14/04/2026
CVE-2026-21515
Critical
N/D
Exposure of sensitive information to an unauthorized actor in Azure IOT Central allows an authorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-23666
Critical
KB5082411
5082411
14/04/2026
CVE-2026-23666
Critical
N/D
Improper input validation in .NET Framework allows an unauthorized attacker to deny service over a network.
14/04/2026
CVE-2026-23666
Critical
KB5082403
5082403
14/04/2026
CVE-2026-23666
Critical
KB5082404
5082404
14/04/2026
CVE-2026-23666
Critical
KB5082414
5082414
14/04/2026
CVE-2026-23666
Critical
KB5082427
5082427
14/04/2026
CVE-2026-23666
Critical
KB5082426
5082426
14/04/2026
CVE-2026-23666
Critical
KB5082413
5082413
14/04/2026
CVE-2026-23666
Critical
KB5082400
5082400
14/04/2026
CVE-2026-23666
Critical
KB5082402
5082402
14/04/2026
CVE-2026-23666
Critical
KB5082425
5082425
14/04/2026
CVE-2026-23666
Critical
KB5082419
5082419
14/04/2026
CVE-2026-23666
Critical
KB5082424
5082424
14/04/2026
CVE-2026-23666
Critical
KB5082417
5082417
14/04/2026
CVE-2026-23666
Critical
KB5082418
5082418
14/04/2026
CVE-2026-23666
Critical
KB5082420
5082420
14/04/2026
CVE-2026-23666
Critical
KB5082398
5082398
14/04/2026
CVE-2026-23666
Critical
KB5082406
5082406
14/04/2026
CVE-2026-23666
Critical
KB5082421
5082421
14/04/2026
CVE-2026-24303
Critical
N/D
Improper access control in Microsoft Partner Center allows an authorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-26135
Critical
N/D
Server-side request forgery (ssrf) in Azure Custom Locations Resource Provider (RP) allows an authorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-26150
Critical
N/D
Server-side request forgery (ssrf) in Microsoft Purview allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-27140
Critical
N/D
N/D
14/04/2026
CVE-2026-27143
Critical
N/D
N/D
14/04/2026
CVE-2026-31478
Critical
N/D
N/D
14/04/2026
CVE-2026-32157
Critical
KB5083768
5083768
14/04/2026
CVE-2026-32157
Critical
N/D
Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network. According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?
This attack requires an authorized user on the client to connect to a malicious server, and that could allow the attacker to gain code execution on the client. How could an attacker exploit this vulnerability?
In the case of a Remote Desktop connection, an attacker with control of a Remote Desktop Server could trigger a remote code execution (RCE) on the machine when a victim connects to the attacking server with a vulnerable Remote Desktop Client.
14/04/2026
399
Visitas totales
162
Visitantes únicos