Authentication bypass by capture-replay in Microsoft Authentication Library (MSAL) for Node.js allows an unauthorized attacker to perform spoofing over a network.
Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally.
Improper authentication in Spring Cloud Azure allows an unauthorized attacker to elevate privileges over a network.
Weak authentication in Windows iSCSI allows an unauthorized attacker to bypass a security feature over a network.
Insufficiently protected credentials in Microsoft Office allows an unauthorized attacker to perform spoofing over a network.
Heap-based buffer overflow in Windows Hello allows an authorized attacker to elevate privileges locally.
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
Double free in Windows Hello allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hello allows an authorized attacker to elevate privileges locally.
Improper encoding or escaping of output in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges locally.
Storing passwords in a recoverable format in Windows DHCP Server allows an authorized attacker to disclose information over a network.
Authentication bypass by spoofing in Windows Netlogon allows an unauthorized attacker to perform spoofing over an adjacent network.
Out-of-bounds read in Windows Key Distribution Center allows an unauthorized attacker to deny service over a network.
Insufficiently protected credentials in GitHub Copilot and Visual Studio Code allows an unauthorized attacker to disclose information over a network.
Improper authentication in Microsoft Authenticator allows an unauthorized attacker to elevate privileges locally.
Insufficiently protected credentials in Azure CycleCloud allows an authorized attacker to disclose information over a network.
Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally.
Improper verification of cryptographic signature in Skype for Business allows an unauthorized attacker to perform spoofing over an adjacent network.
Double free in Windows Credential Guard allows an authorized attacker to elevate privileges locally.
Use of client-side authentication in Skype for Business allows an authorized attacker to perform spoofing over a network.
Use after free in Windows Hello allows an authorized attacker to elevate privileges locally.
Authentication bypass by capture-replay in Windows Kerberos allows an authorized attacker to execute code over a network.
Heap-based buffer overflow in Windows Credential Providers allows an authorized attacker to elevate privileges locally.
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
Authentication bypass using an alternate path or channel in Microsoft Entra ID allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-62916 Microsoft US
Authorization bypass through user-controlled key in Azure Cosmos DB allows an authorized attacker to perform spoofing over a network.
EPSS 0.00 CVE-2026-69857 US
Authorization bypass through user-controlled key in Microsoft Azure Active Directory B2C allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-83711 Microsoft US
Missing authentication for critical function in Azure AI Language allows an unauthorized attacker to elevate privileges over a network.
EPSS 0.01 CVE-2026-70352 US
Incorrect authorization in Microsoft Edge (Chromium-based) allows an unauthorized attacker to disclose information over a network.
EPSS 0.00 CVE-2026-62904 Microsoft US