Microsoft Uses LLMs for vuln discovery
CPE vendor key: microsoft ·
8,404 CVEs published in the last 24 months.
CVEs (365 d)
6,432
▲ +435 vs prior 30d
Avg CVSS (365 d)
7.37
over 6,432 CVEs
Avg EPSS pct (365 d)
0.34
higher = more likely exploited
KEV hit rate (365 d)
0.6%
38 of 6,432 added to CISA KEV
LLM-credited CVEs
262
Openai 258 · Anthropic 4
Monthly CVE volume — last 24 months
Each point is one calendar month. Bars in the
severity card to the right slice the same volume by CVSS band.
Severity mix
Stacked by CVSS band (Critical / High / Medium /
Low) using the best available metric per CVE.
Top affected products (24 mo)
2,675
2,597
2,505
2,459
2,337
2,215
2,212
2,211
2,018
2,009
Distinct CVEs that include each product in their
CPE configuration.
Top CWEs (24 mo)
1,615
1,290
882
342
335
320
218
207
169
154
Distinct CVEs assigned each weakness.
Recent CISA KEV adds (last 12 months)
| Added | CVE | Product | KEV name |
|---|---|---|---|
| 2026-10-13 | CVE-2026-96951 | Windows | Microsoft Windows Command Injection Vulnerability |
| 2026-09-25 | CVE-2026-65660 | SharePoint | Microsoft SharePoint Code Injection Vulnerability |
| 2026-09-08 | CVE-2026-85880 | Windows | Microsoft Windows Heap-Based Buffer Overflow Vulnerability |
| 2026-09-08 | CVE-2026-81963 | Windows | Microsoft Windows Link Following Vulnerability |
| 2026-08-26 | CVE-2019-1068 | SQL Server | Microsoft SQL Server Remote Code Execution Vulnerability |
| 2026-08-18 | CVE-2026-55040 | SharePoint | Microsoft SharePoint Weak Authentication Vulnerability |
| 2026-08-18 | CVE-2026-33824 | Internet Key Exchange (IKE) Service Extensions | Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability |
| 2026-08-11 | CVE-2026-68820 | Windows Ancillary Function Driver for WinSock | Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability |
| 2026-07-22 | CVE-2026-50522 | SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
| 2026-07-16 | CVE-2026-58644 | SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
| 2026-07-14 | CVE-2026-56164 | SharePoint Server | Microsoft SharePoint Server Missing Authentication for Critical Function Vulnerability |
| 2026-07-14 | CVE-2026-56155 | Active Directory Federation Services | Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability |
| 2026-07-01 | CVE-2026-45659 | SharePoint Server | Microsoft SharePoint Server Deserialization of Untrusted Data Vulnerability |
| 2026-05-20 | CVE-2026-45498 | Defender | Microsoft Defender Denial of Service Vulnerability |
| 2026-05-20 | CVE-2026-41091 | Defender | Microsoft Defender Link Following Vulnerability |
| 2026-05-20 | CVE-2010-0806 | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability |
| 2026-05-20 | CVE-2010-0249 | Internet Explorer | Microsoft Internet Explorer Use-After-Free Vulnerability |
| 2026-05-20 | CVE-2009-1537 | DirectX | Microsoft DirectX NULL Byte Overwrite Vulnerability |
| 2026-05-20 | CVE-2008-4250 | Windows | Microsoft Windows Buffer Overflow Vulnerability |
| 2026-05-15 | CVE-2026-42897 | Microsoft | Microsoft Exchange Server Cross-Site Scripting Vulnerability |
| 2026-04-28 | CVE-2026-32202 | Windows | Microsoft Windows Protection Mechanism Failure Vulnerability |
| 2026-04-22 | CVE-2026-33825 | Defender | Microsoft Defender Insufficient Granularity of Access Control Vulnerability |
| 2026-04-14 | CVE-2026-32201 | SharePoint Server | Microsoft SharePoint Server Improper Input Validation Vulnerability |
| 2026-04-14 | CVE-2009-0238 | Office | Microsoft Office Remote Code Execution |
| 2026-04-13 | CVE-2025-60710 | Windows | Microsoft Windows Link Following Vulnerability |
| 2026-04-13 | CVE-2023-36424 | Windows | Microsoft Windows Out-of-Bounds Read Vulnerability |
| 2026-04-13 | CVE-2023-21529 | Exchange Server | Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability |
| 2026-04-13 | CVE-2012-1854 | Visual Basic for Applications (VBA) | Microsoft Visual Basic for Applications Insecure Library Loading Vulnerability |
| 2026-03-18 | CVE-2026-20963 | SharePoint | Microsoft SharePoint Deserialization of Untrusted Data Vulnerability |
| 2026-02-17 | CVE-2008-0015 | Windows | Microsoft Windows Video ActiveX Control Remote Code Execution Vulnerability |
| 2026-02-12 | CVE-2024-43468 | Configuration Manager | Microsoft Configuration Manager SQL Injection Vulnerability |
| 2026-02-10 | CVE-2026-21533 | Windows | Microsoft Windows Improper Privilege Management Vulnerability |
| 2026-02-10 | CVE-2026-21525 | Windows | Microsoft Windows NULL Pointer Dereference Vulnerability |
| 2026-02-10 | CVE-2026-21519 | Windows | Microsoft Windows Type Confusion Vulnerability |
| 2026-02-10 | CVE-2026-21514 | Office | Microsoft Office Word Reliance on Untrusted Inputs in a Security Decision Vulnerability |
| 2026-02-10 | CVE-2026-21513 | Windows | Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability |
| 2026-02-10 | CVE-2026-21510 | Windows | Microsoft Windows Shell Protection Mechanism Failure Vulnerability |
| 2026-01-26 | CVE-2026-21509 | Office | Microsoft Office Security Feature Bypass Vulnerability |
| 2026-01-13 | CVE-2026-20805 | Windows | Microsoft Windows Information Disclosure Vulnerability |
| 2026-01-07 | CVE-2009-0556 | Office | Microsoft Office PowerPoint Code Injection Vulnerability |
| 2025-12-09 | CVE-2025-62221 | Windows | Microsoft Windows Use After Free Vulnerability |
| 2025-11-12 | CVE-2025-62215 | Windows | Microsoft Windows Race Condition Vulnerability |
| 2025-10-24 | CVE-2025-59287 | Windows | Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability |
Filtered to KEV entries whose CISA vendor or product name matches this
vendor exactly, to drop cross-OS noise (e.g. third-party Windows apps
that CPE-map to Microsoft).
Known exploited, all time (494)
Attributed by CPE rather than by CISA's vendor name, so it includes
CVEs filed under another vendor whose affected-product list names this
one — shared library code is the usual reason. Broader, and
noisier, than the name-matched card above on purpose.
LLM-credited CVEs from this vendor
| Published | CVE | LLM family | Model(s) |
|---|---|---|---|
| 2026-10-13 | CVE-2026-110150 | anthropic | Anthropic |
| 2026-10-13 | CVE-2026-110144 | anthropic | Anthropic |
| 2026-10-06 | CVE-2026-106420 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106376 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106373 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106355 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106340 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106284 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106272 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106258 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106236 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106215 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106214 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106202 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106186 | openai | OpenAI |
| 2026-10-06 | CVE-2026-106183 | openai | OpenAI |
| 2026-10-02 | CVE-2026-103626 | anthropic | Anthropic |
| 2026-10-02 | CVE-2026-103624 | anthropic | Anthropic |
| 2026-09-29 | CVE-2026-102317 | openai | OpenAI |
| 2026-09-29 | CVE-2026-102315 | openai | OpenAI |
| 2026-09-29 | CVE-2026-102313 | openai | OpenAI |
| 2026-09-29 | CVE-2026-95385 | openai | OpenAI |
| 2026-09-09 | CVE-2026-87654 | openai | OpenAI |
| 2026-09-09 | CVE-2026-87653 | openai | OpenAI |
| 2026-09-09 | CVE-2026-87648 | openai | OpenAI |
From
mythos_attributed_cves: CVEs whose NVD description
or vendor advisory credits an LLM-assisted discovery. Confidence is
high for every row.
Generated 16 October 2026 12:22 UTC .