{"apiVersion":"1","notice":"Security Threat Pulse API v1. Free, no key. Facts with sources; verdicts follow the published rules at https://securitythreatpulse.com/methodology. Not advice. Some source data is withheld here until its terms allow re-serving.","generatedAt":"2026-11-11T08:30:29.002Z","products":["microsoft"],"actNowTotal":6,"results":[{"query":"microsoft","matched":8,"actNow":6,"events":[{"id":"kev-2026-11-10-microsoft-office","url":"https://securitythreatpulse.com/events/kev-2026-11-10-microsoft-office","title":"Microsoft Office: security flaw used in attacks","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is new today, so almost nothing is patched yet.","tier":"now","rankScore":6,"rankWhy":["Exploitation is confirmed by an authoritative source.","The confirmation is 1 day old.","7 products are affected."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-124194"],"vendor":"Microsoft","product":"Office","affectedProducts":[{"kind":"direct","slug":"microsoft/office","vendor":"Microsoft","product":"Office","evidence":["kev"],"vendorKey":"microsoft","productKey":"office"},{"kind":"direct","slug":"microsoft/microsoft365appsforenterprise","vendor":"Microsoft","product":"Microsoft 365 Apps For Enterprise","evidence":["cpe"],"vendorKey":"microsoft","productKey":"microsoft365appsforenterprise"},{"kind":"direct","slug":"microsoft/microsoftofficeltsc2021","vendor":"Microsoft","product":"Microsoft Office Ltsc 2021","evidence":["cpe"],"vendorKey":"microsoft","productKey":"microsoftofficeltsc2021"},{"kind":"direct","slug":"microsoft/microsoftofficeltsc2024","vendor":"Microsoft","product":"Microsoft Office Ltsc 2024","evidence":["cpe"],"vendorKey":"microsoft","productKey":"microsoftofficeltsc2024"},{"kind":"direct","slug":"microsoft/365apps","vendor":"Microsoft","product":"365 Apps","evidence":["cpe"],"vendorKey":"microsoft","productKey":"365apps"},{"kind":"direct","slug":"microsoft/office2021","vendor":"Microsoft","product":"Office 2021","evidence":["cpe"],"vendorKey":"microsoft","productKey":"office2021"},{"kind":"direct","slug":"microsoft/office2024","vendor":"Microsoft","product":"Office 2024","evidence":["cpe"],"vendorKey":"microsoft","productKey":"office2024"}],"category":{"id":"other","label":"Other software","why":"Software we have not put in a category yet. Your IT team or provider will know whether you run it.","doThis":"Find out if you use it. If you do, apply the vendor's fix."},"summary":"Microsoft Office Outlook contains a missing user interaction for potentially unsafe action vulnerability that allows an unauthorized attacker to perform spoofing over a network.","cvss":6.5,"epss":null,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-11-10","kevDueDate":"2026-11-24","firstSeenAt":"2026-11-10T00:00:00.000Z","updatedAt":"2026-11-11T02:30:23.338Z","newestEvidenceAt":"2026-11-11T06:56:19.939Z"},{"id":"kev-2026-10-27-google-brotli","url":"https://securitythreatpulse.com/events/kev-2026-10-27-google-brotli","title":"Google Brotli: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 19 days old, so many systems are likely still unpatched. The severity score is critical (9.2). The exploit prediction score is 83%.","tier":"now","rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","The confirmation is 15 days old.","12 products are affected."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-111497"],"vendor":"Google","product":"Brotli","affectedProducts":[{"kind":"direct","slug":"google/brotli","vendor":"Google","product":"Brotli","evidence":["kev","cpe"],"vendorKey":"google","productKey":"brotli"},{"kind":"direct","slug":"nodejs/nodejs","vendor":"Nodejs","product":"Nodejs","evidence":["cpe"],"vendorKey":"nodejs","productKey":"nodejs"},{"kind":"direct","slug":"pythonhyper/brotlicffi","vendor":"Python-hyper","product":"Brotlicffi","evidence":["cpe"],"vendorKey":"pythonhyper","productKey":"brotlicffi"},{"kind":"direct","slug":"microsoft/net","vendor":"Microsoft","product":".NET","evidence":["cpe"],"vendorKey":"microsoft","productKey":"net"},{"kind":"direct","slug":"debian/debianlinux","vendor":"Debian","product":"Debian Linux","evidence":["cpe"],"vendorKey":"debian","productKey":"debianlinux"},{"kind":"direct","slug":"istio/istio","vendor":"Istio","product":"Istio","evidence":["cpe"],"vendorKey":"istio","productKey":"istio"},{"kind":"direct","slug":"anthropic/bun","vendor":"Anthropic","product":"Bun","evidence":["cpe"],"vendorKey":"anthropic","productKey":"bun"},{"kind":"direct","slug":"envoyproxy/envoy","vendor":"Envoyproxy","product":"Envoy","evidence":["cpe"],"vendorKey":"envoyproxy","productKey":"envoy"},{"kind":"direct","slug":"tianocore/edk2","vendor":"Tianocore","product":"Edk2","evidence":["cpe"],"vendorKey":"tianocore","productKey":"edk2"},{"kind":"direct","slug":"google/woff2","vendor":"Google","product":"Woff2","evidence":["cpe"],"vendorKey":"google","productKey":"woff2"},{"kind":"direct","slug":"duckdb/duckdb","vendor":"Duckdb","product":"Duckdb","evidence":["cpe"],"vendorKey":"duckdb","productKey":"duckdb"},{"kind":"direct","slug":"clickhouse/clickhouse","vendor":"Clickhouse","product":"Clickhouse","evidence":["cpe"],"vendorKey":"clickhouse","productKey":"clickhouse"}],"category":{"id":"endpoint","label":"Computers, phones and browsers","why":"It runs on staff computers, phones or browsers.","doThis":"Install the latest updates on every device, and turn on automatic updates."},"summary":"Google Brotli contains an unchecked return value vulnerability that allows a remote unauthenticated attacker to corrupt adjacent decoder state memory, disclose sensitive memory contents, cause a denial of service, or potentially execute arbitrary code using a crafted Brotli-compressed stream.","cvss":9.2,"epss":0.82641,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-10-27","kevDueDate":"2026-11-10","firstSeenAt":"2026-10-27T00:00:00.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-11T07:30:04.059Z"},{"id":"kev-2026-10-13-microsoft-windows","url":"https://securitythreatpulse.com/events/kev-2026-10-13-microsoft-windows","title":"Microsoft Windows: attackers can run commands on it","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 28 days old, so many systems are likely still unpatched.","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","12 products are affected."],"rulesVersion":"v3","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-96951"],"vendor":"Microsoft","product":"Windows","affectedProducts":[{"kind":"direct","slug":"microsoft/windows","vendor":"Microsoft","product":"Windows","evidence":["kev"],"vendorKey":"microsoft","productKey":"windows"},{"kind":"direct","slug":"microsoft/microsoftedgechromiumbased","vendor":"Microsoft","product":"Microsoft Edge (chromium-based)","evidence":["cpe"],"vendorKey":"microsoft","productKey":"microsoftedgechromiumbased"},{"kind":"direct","slug":"microsoft/outlookcom","vendor":"Microsoft","product":"Outlook.com","evidence":["cpe"],"vendorKey":"microsoft","productKey":"outlookcom"},{"kind":"direct","slug":"microsoft/windows10version1607","vendor":"Microsoft","product":"Windows 10 Version 1607","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows10version1607"},{"kind":"direct","slug":"microsoft/windows10version1809","vendor":"Microsoft","product":"Windows 10 Version 1809","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows10version1809"},{"kind":"direct","slug":"microsoft/windows10version21h2","vendor":"Microsoft","product":"Windows 10 Version 21h2","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows10version21h2"},{"kind":"direct","slug":"microsoft/windows10version22h2","vendor":"Microsoft","product":"Windows 10 Version 22h2","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows10version22h2"},{"kind":"direct","slug":"microsoft/windows11version23h2","vendor":"Microsoft","product":"Windows 11 Version 23h2","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows11version23h2"},{"kind":"direct","slug":"microsoft/windows11version24h2","vendor":"Microsoft","product":"Windows 11 Version 24h2","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows11version24h2"},{"kind":"direct","slug":"microsoft/windows11version25h2","vendor":"Microsoft","product":"Windows 11 Version 25h2","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows11version25h2"},{"kind":"direct","slug":"microsoft/windows11version26h1","vendor":"Microsoft","product":"Windows 11 Version 26h1","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows11version26h1"},{"kind":"direct","slug":"microsoft/windows11version26h2","vendor":"Microsoft","product":"Windows 11 Version 26h2","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows11version26h2"}],"category":{"id":"endpoint","label":"Computers, phones and browsers","why":"It runs on staff computers, phones or browsers.","doThis":"Install the latest updates on every device, and turn on automatic updates."},"summary":"Microsoft Windows Shell contains a command injection vulnerability that allows an unauthorized attacker to bypass a security feature over a network.","cvss":8.8,"epss":0.09813,"exploitMaturity":"none","kevListed":true,"kevDateAdded":"2026-10-13","kevDueDate":"2026-10-16","firstSeenAt":"2026-10-13T00:00:00.000Z","updatedAt":"2026-11-10T19:31:15.956Z","newestEvidenceAt":"2026-11-07T11:04:10.611Z"},{"id":"kev-2026-09-25-microsoft-sharepoint","url":"https://securitythreatpulse.com/events/kev-2026-09-25-microsoft-sharepoint","title":"Microsoft SharePoint: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 91 days old, so many systems are likely still unpatched.","tier":"now","rankScore":4,"rankWhy":["Exploitation is confirmed by an authoritative source.","4 products are affected."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-65660"],"vendor":"Microsoft","product":"SharePoint","affectedProducts":[{"kind":"direct","slug":"microsoft/sharepoint","vendor":"Microsoft","product":"SharePoint","evidence":["kev"],"vendorKey":"microsoft","productKey":"sharepoint"},{"kind":"direct","slug":"microsoft/microsoftsharepointenterpriseserver2016","vendor":"Microsoft","product":"Microsoft Sharepoint Enterprise Server 2016","evidence":["cpe"],"vendorKey":"microsoft","productKey":"microsoftsharepointenterpriseserver2016"},{"kind":"direct","slug":"microsoft/microsoftsharepointserver2019","vendor":"Microsoft","product":"Microsoft Sharepoint Server 2019","evidence":["cpe"],"vendorKey":"microsoft","productKey":"microsoftsharepointserver2019"},{"kind":"direct","slug":"microsoft/microsoftsharepointserversubscriptionedition","vendor":"Microsoft","product":"Microsoft Sharepoint Server Subscription Edition","evidence":["cpe"],"vendorKey":"microsoft","productKey":"microsoftsharepointserversubscriptionedition"}],"category":{"id":"collaboration","label":"Documents and collaboration","why":"It holds shared documents and internal pages.","doThis":"Patch it, or ask your provider whether they have."},"summary":"Microsoft SharePoint contains a code injection vulnerability which could allow an authorized attacker to execute code over a network.","cvss":8.8,"epss":0.09852,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-25","kevDueDate":"2026-09-28","firstSeenAt":"2026-09-25T00:00:00.000Z","updatedAt":"2026-11-10T17:30:23.613Z","newestEvidenceAt":"2026-11-05T10:06:28.695Z"},{"id":"kev-2026-09-08-microsoft-windows","url":"https://securitythreatpulse.com/events/kev-2026-09-08-microsoft-windows","title":"Microsoft Windows: 2 flaws used in attacks; attackers can gain admin rights","verdict":"act_now","verdictReason":"Attacks are confirmed. The vulnerability is 60 days old, so current versions are being attacked.","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"confirmed","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-81963","CVE-2026-85880"],"vendor":"Microsoft","product":"Windows","affectedProducts":[{"vendorKey":"microsoft","productKey":"windows","vendor":"Microsoft","product":"Windows","slug":"microsoft/windows","kind":"direct","evidence":["kev"]}],"category":{"id":"endpoint","label":"Computers, phones and browsers","why":"It runs on staff computers, phones or browsers.","doThis":"Install the latest updates on every device, and turn on automatic updates."},"summary":"Microsoft Windows Update Stack contains a link following vulnerability that allows a local attacker to escalate privileges locally up to SYSTEM.","cvss":7.8,"epss":0.00393,"exploitMaturity":"poc","kevListed":true,"kevDateAdded":"2026-09-08","kevDueDate":"2026-09-22","firstSeenAt":"2026-09-08T00:00:00.000Z","updatedAt":"2026-11-07T17:22:40.206Z","newestEvidenceAt":"2026-11-04T06:24:45.979Z"},{"id":"kev-2026-08-26-microsoft-sql-server","url":"https://securitythreatpulse.com/events/kev-2026-08-26-microsoft-sql-server","title":"Microsoft SQL Server: attackers can run their own code","verdict":"act_now","verdictReason":"Attacks are confirmed. The exploit prediction score is 57%.","tier":null,"rankScore":null,"rankWhy":null,"rulesVersion":"v2","ladder":{"talk":"none","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2019-1068"],"vendor":"Microsoft","product":"SQL Server","affectedProducts":[{"vendorKey":"microsoft","productKey":"sqlserver","vendor":"Microsoft","product":"SQL Server","slug":"microsoft/sqlserver","kind":"direct","evidence":["kev"]}],"category":{"id":"server-backup","label":"Servers and backups","why":"It runs or protects many systems at once, including your backups.","doThis":"Patch it and keep its admin access off the internet."},"summary":"Microsoft SQL Server contains a remote code execution vulnerability that could allow an attacker to execute code in the context of the SQL Server Database Engine service account.","cvss":8.8,"epss":0.57273,"exploitMaturity":"none","kevListed":true,"kevDateAdded":"2026-08-26","kevDueDate":"2026-08-29","firstSeenAt":"2026-08-26T00:00:00.000Z","updatedAt":"2026-10-24T23:22:40.337Z","newestEvidenceAt":"2026-08-26T00:00:00.000Z"},{"id":"early-cve-2026-118207","url":"https://securitythreatpulse.com/events/early-cve-2026-118207","title":"Microsoft Exchange Server Subscription Edition RTM: attackers can run their own code","verdict":"watch","verdictReason":"One source reports attacks and the vulnerability is new today. In our backtest a single early report was confirmed within 30 days about one time in twenty, so we wait for a second report or for attack attempts to be seen.","tier":null,"rankScore":5,"rankWhy":["Exploitation is reported.","The product faces the internet or gives remote access.","The first report is from today."],"rulesVersion":"v3","ladder":{"talk":"none","damage":"none","attempts":"reported","exposure":"none","exploited":"reported"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2026-118207"],"vendor":"Microsoft","product":"Microsoft Exchange Server Subscription Edition RTM","affectedProducts":[{"kind":"direct","slug":"microsoft/microsoftexchangeserversubscriptioneditionrtm","vendor":"Microsoft","product":"Microsoft Exchange Server Subscription Edition RTM","evidence":["cna","cpe"],"vendorKey":"microsoft","productKey":"microsoftexchangeserversubscriptioneditionrtm"}],"category":{"id":"email","label":"Email","why":"It carries internal and customer mail.","doThis":"Patch it, or ask your email provider whether they have."},"summary":"Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.","cvss":8.8,"epss":null,"exploitMaturity":"none","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-11-11T03:38:18.000Z","updatedAt":"2026-11-11T07:30:23.092Z","newestEvidenceAt":"2026-11-11T03:38:18.000Z"},{"id":"early-cve-2022-21894","url":"https://securitythreatpulse.com/events/early-cve-2022-21894","title":"Microsoft Windows 10 Version 1809: security flaw reported in attacks","verdict":"watch","verdictReason":"Attacks are confirmed, but the vulnerability is more than a year old and we see no ransomware use, public attack tools, internet-facing product, critical severity or high prediction score. Check whether it applies to you.","tier":null,"rankScore":5,"rankWhy":["Exploitation is confirmed by an authoritative source.","The first report is 20 days old.","12 products are affected."],"rulesVersion":"v3","ladder":{"talk":"reported","damage":"none","attempts":"confirmed","exposure":"none","exploited":"confirmed"},"untrackedRungs":["exposure","damage"],"cves":["CVE-2022-21894"],"vendor":"Microsoft","product":"Windows 10 Version 1809","affectedProducts":[{"kind":"direct","slug":"microsoft/windows10version1809","vendor":"Microsoft","product":"Windows 10 Version 1809","evidence":["cna","cpe"],"vendorKey":"microsoft","productKey":"windows10version1809"},{"kind":"direct","slug":"microsoft/windowsserver2019","vendor":"Microsoft","product":"Windows Server 2019","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windowsserver2019"},{"kind":"direct","slug":"microsoft/windowsserver2019servercoreinstallation","vendor":"Microsoft","product":"Windows Server 2019 (server Core Installation)","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windowsserver2019servercoreinstallation"},{"kind":"direct","slug":"microsoft/windows10version1909","vendor":"Microsoft","product":"Windows 10 Version 1909","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows10version1909"},{"kind":"direct","slug":"microsoft/windows10version21h1","vendor":"Microsoft","product":"Windows 10 Version 21h1","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows10version21h1"},{"kind":"direct","slug":"microsoft/windowsserver2022","vendor":"Microsoft","product":"Windows Server 2022","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windowsserver2022"},{"kind":"direct","slug":"microsoft/windows10version20h2","vendor":"Microsoft","product":"Windows 10 Version 20h2","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows10version20h2"},{"kind":"direct","slug":"microsoft/windowsserverversion20h2","vendor":"Microsoft","product":"Windows Server Version 20h2","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windowsserverversion20h2"},{"kind":"direct","slug":"microsoft/windows11version21h2","vendor":"Microsoft","product":"Windows 11 Version 21h2","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows11version21h2"},{"kind":"direct","slug":"microsoft/windows10version21h2","vendor":"Microsoft","product":"Windows 10 Version 21h2","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows10version21h2"},{"kind":"direct","slug":"microsoft/windows10version1507","vendor":"Microsoft","product":"Windows 10 Version 1507","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows10version1507"},{"kind":"direct","slug":"microsoft/windows10version1607","vendor":"Microsoft","product":"Windows 10 Version 1607","evidence":["cpe"],"vendorKey":"microsoft","productKey":"windows10version1607"}],"category":{"id":"endpoint","label":"Computers, phones and browsers","why":"It runs on staff computers, phones or browsers.","doThis":"Install the latest updates on every device, and turn on automatic updates."},"summary":"Secure Boot Security Feature Bypass Vulnerability","cvss":4.4,"epss":0.09116,"exploitMaturity":"poc","kevListed":false,"kevDateAdded":null,"kevDueDate":null,"firstSeenAt":"2026-10-22T16:44:37.000Z","updatedAt":"2026-11-11T00:00:06.173Z","newestEvidenceAt":"2026-11-09T18:16:08.872Z"}]}]}