Microsoft
CVE-2026-21510: Windows Shell and SmartScreen warning bypass
A malicious link or shortcut can bypass SmartScreen and Windows Shell warnings after a user opens it. Execution may proceed without the expected prompt; update the affected Windows branch and investigate downloaded shortcuts and follow-on activity.
CVE-2008-0015: Legacy Windows Video ActiveX Control RCE
A crafted page using the Windows Video ActiveX control can execute code with the logged-on user's rights in legacy Internet Explorer. Verify the control's kill-bit protection on affected hosts, while retiring unsupported Windows systems.
CVE-2024-43468: Configuration Manager unauthenticated SQL injection
Unauthenticated requests can trigger commands on Configuration Manager servers or their databases. Remediation requires the revised in-console package and applicable site procedures, not merely a Windows update or the original package carrying the same KB number.
CVE-2026-20963: SharePoint unauthenticated deserialization RCE
Microsoft's corrected SharePoint FAQ describes unauthenticated network code execution. Its March revision clarified prerequisites and scoring without changing the January update requirement; apply the applicable farm-wide fix and preserve evidence of possible earlier access.
CVE-2026-32201: SharePoint unauthenticated spoofing vulnerability
SharePoint's exploited spoofing flaw permits unauthenticated access to some sensitive information and changes to that information. It does not establish arbitrary account takeover or code execution; match updates to each on-premises farm server.
CVE-2009-0238: Legacy Microsoft Excel file remote code execution
Opening a crafted legacy Excel file can run code with the logged-on user's rights; receiving an email alone is insufficient. Match historical Excel, Viewer and Mac updates, including paired packages where required, and replace unsupported installations.
CVE-2025-60710: Windows link-following privilege escalation
Improper link resolution in Host Process for Windows Tasks can elevate a local authorized attacker to SYSTEM. Microsoft's December 2025 re-release requires revised updates; November-only patch records do not establish protection against this ransomware-associated flaw.
CVE-2023-36424: Windows Common Log File System privilege escalation
Windows CLFS exploitation can elevate a local attacker from Medium to High Integrity Level; the source does not establish SYSTEM access. Use a supported superseding update, not an expired historical package, and investigate suspicious privilege transitions.
CVE-2023-21529: Exchange Server authenticated deserialization RCE
Authenticated Exchange network calls can trigger deserialization code execution in the server-account context without requiring a user to open mail. CISA records ransomware use; match each server's cumulative-update branch and investigate separately from patch installation.
CVE-2012-1854: Legacy VBA insecure library loading RCE
Opening a legitimate Office document beside an attacker's DLL can trigger legacy VBA code execution with the user's rights. Inventory private VBE6.dll copies in third-party applications; an Office update may leave those runtimes unchanged.