Consulta vulnerabilidades CVE, conoce su impacto y verifica las medidas de corrección en fuentes oficiales.
CVE
Riesgo
KB asociado
Descripcion del KB
Fecha de liberacion
CVE-2026-32157
Critical
KB5082123
5082123
14/04/2026
CVE-2026-32157
Critical
KB5082142
5082142
14/04/2026
CVE-2026-32157
Critical
KB5082200
5082200
14/04/2026
CVE-2026-32157
Critical
KB5082063
5082063
14/04/2026
CVE-2026-32157
Critical
KB5083769
5083769
14/04/2026
CVE-2026-32157
Critical
KB5082052
5082052
14/04/2026
CVE-2026-32157
Critical
KB5082060
5082060
14/04/2026
CVE-2026-32157
Critical
KB5082198
5082198
14/04/2026
CVE-2026-32157
Critical
KB5082127
5082127
14/04/2026
CVE-2026-32157
Critical
KB5082126
5082126
14/04/2026
CVE-2026-32172
Critical
N/D
Uncontrolled search path element in Microsoft Power Apps allows an unauthorized attacker to execute code over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-32173
Critical
N/D
Improper authentication in Azure SRE Agent allows an unauthorized attacker to disclose information over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-32186
Critical
N/D
Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-32190
Critical
N/D
Use after free in Microsoft Office allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
14/04/2026
CVE-2026-32210
Critical
N/D
Server-side request forgery (ssrf) in Microsoft Dynamics 365 (Online) allows an unauthorized attacker to perform spoofing over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-32211
Critical
N/D
Missing authentication for critical function in Azure MCP Server allows an unauthorized attacker to disclose information over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-32213
Critical
N/D
Improper authorization in Azure AI Foundry allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-33102
Critical
N/D
Url redirection to untrusted site ('open redirect') in M365 Copilot allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-33105
Critical
N/D
Improper authorization in Microsoft Azure Kubernetes Service allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-33107
Critical
N/D
Server-side request forgery (ssrf) in Azure Databricks allows an unauthorized attacker to elevate privileges over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-33114
Critical
N/D
Untrusted pointer dereference in Microsoft Office Word allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
14/04/2026
CVE-2026-33115
Critical
N/D
Use after free in Microsoft Office Word allows an unauthorized attacker to execute code locally. According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?
The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability. Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
14/04/2026
CVE-2026-33819
Critical
N/D
Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network. Why are there no links to an update or instructions with steps that must be taken to protect from this vulnerability?
This vulnerability has already been fully mitigated by Microsoft. There is no action for users of this service to take. The purpose of this CVE is to provide further transparency.
Please see Toward greater transparency: Unveiling Cloud Service CVEs for more information.
14/04/2026
CVE-2026-33824
Critical
KB5082123
5082123
14/04/2026
CVE-2026-33824
Critical
N/D
The following mitigating factors might be helpful in your situation:
Customers who cannot immediately install the security update can take one of the following actions, depending on their environment:
Block inbound traffic on UDP ports 500 and 4500 for systems that do not use IKE.
For systems that require IKE, configure firewall rules to allow inbound traffic on UDP ports 500 and 4500 only from known peer addresses.
These actions reduce the attack surface but do not replace installing the security update
14/04/2026
CVE-2026-33824
Critical
KB5082142
5082142
14/04/2026
CVE-2026-33824
Critical
KB5082200
5082200
14/04/2026
CVE-2026-33824
Critical
KB5082063
5082063
14/04/2026
CVE-2026-33824
Critical
KB5083769
5083769
14/04/2026
CVE-2026-33824
Critical
KB5082052
5082052
14/04/2026
CVE-2026-33824
Critical
KB5082060
5082060
14/04/2026
CVE-2026-33824
Critical
KB5083768
5083768
14/04/2026
CVE-2026-33824
Critical
KB5082198
5082198
14/04/2026
CVE-2026-33826
Critical
KB5082123
5082123
14/04/2026
CVE-2026-33826
Critical
N/D
Improper input validation in Windows Active Directory allows an authorized attacker to execute code over an adjacent network. How could an attacker exploit this vulnerability?
To exploit this vulnerability, an authenticated attacker would need to send a specially crafted RPC call to an RPC host. This could result in remote code execution on the server side with the same permissions as the RPC service. According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires that an attacker needs to be in the same restricted Active Directory domain as the target system. The attack surface is not reachable from broader networks, which is why the attack vector is considered adjacent (AV:A).
14/04/2026
CVE-2026-33826
Critical
KB5082142
5082142
14/04/2026
CVE-2026-33826
Critical
KB5082063
5082063
14/04/2026
CVE-2026-33826
Critical
KB5082060
5082060
14/04/2026
CVE-2026-33826
Critical
KB5082198
5082198
14/04/2026
CVE-2026-33826
Critical
KB5082126
5082126
14/04/2026
CVE-2026-33827
Critical
KB5082123
5082123
14/04/2026
CVE-2026-33827
Critical
N/D
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over a network. According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to win a race condition and also to take additional actions prior to exploitation to prepare the target environment. How could an attacker exploit this vulnerability?
An unauthenticated attacker could send a specially crafted IPv6 packet to a Windows node where IPSec is enabled, which could enable a remote code execution exploitation on that machine.
14/04/2026
CVE-2026-33827
Critical
KB5082142
5082142
14/04/2026
CVE-2026-33827
Critical
KB5082200
5082200
14/04/2026
CVE-2026-33827
Critical
KB5082063
5082063
14/04/2026
CVE-2026-33827
Critical
KB5083769
5083769
14/04/2026
CVE-2026-33827
Critical
KB5082052
5082052
14/04/2026
CVE-2026-33827
Critical
KB5082060
5082060
14/04/2026
CVE-2026-33827
Critical
KB5083768
5083768
14/04/2026
CVE-2026-33827
Critical
KB5082198
5082198
14/04/2026
398
Visitas totales
162
Visitantes únicos