Microsoft in the 2026 KEV: what was exploited, what to patch

Between January 1 and November 3, 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added 283 vulnerabilities to its KEV (Known Exploited Vulnerabilities) catalog: the public list of flaws with reliable evidence of exploitation in real attacks. Microsoft was the vendor with the most entries: 40, 14.1% of the total, among 106 vendors. The runner-up, Cisco, had 20.

If your company runs Windows, Office, SharePoint or Exchange, this is a concrete list of flaws already used in attacks. We cross-referenced each entry with cve.org and Microsoft's security bulletins (MSRC) to find out which products it affects, what type of flaw it is, how much margin there was between patch and known exploitation, and what to patch first.

Key figures

• 40 of 283 KEV entries (14.1%) are Microsoft's. Top products: Windows and its components, 17; SharePoint Server, 8; Office (Word, PowerPoint, VBA), 5.
• 17 (42.5%) were zero-days under our criterion: they were added to the KEV on the same day the CVE was published. Microsoft flags all 17 as exploited in its bulletin.
• Of the 27 CVEs published in 2026, the median time from publication to KEV entry was 0 days.
• 4 (10%) have known use in ransomware campaigns according to CISA; none of them was a zero-day.
• 8 are CVEs from 2015 or earlier; the oldest dates from 2008.
• SharePoint Server received 7 of the 10 remediation deadlines of 3 days that CISA set for these entries.

Method

We used only public data, downloaded on November 4, 2026 (14:33 UTC):

• CISA's KEV catalog, version 2026.11.03 (1,767 entries in total), taken from CISA's official GitHub mirror at commit fee9528.
• CVE records from cve.org (cveawg.mitre.org API), for each CVE's publication date.
• Microsoft security bulletins in CVRF format (MSRC API), for the impact type and the exploitation flag. We found 32 of the 40 CVEs; the other 8, all from 2015 or earlier, are not in that API.

Calculation rules:

• Period: entries whose KEV date added falls between January 1, 2026 and November 3, 2026, inclusive. We count by date added, not by CVE year.
• Product: we group the KEV product field into families with a rule published in the script, because the catalog is not consistent (it uses both "SharePoint" and "SharePoint Server").
• Flaw type: the impact classification Microsoft publishes in its bulletin (remote code execution, elevation of privilege, etc.).
• Days to exploitation: KEV date added minus the CVE publication date on cve.org, in calendar days.
• Zero-day: the CVE was added to the KEV on or before its publication date. In other words, when Microsoft released the patch, CISA already had evidence of exploitation. As a cross-check, we reviewed the "Exploited: Yes" flag in Microsoft's bulletin.
• Patch Tuesday: the second Tuesday of each month, when Microsoft releases its monthly security update, typically at 10:00 AM US Pacific Time, according to its documentation.
• Ransomware: the KEV field knownRansomwareCampaignUse = "Known".
• Verification: every CVE we name was checked against its cve.org record (vendor and product).

How to reproduce it

cve.org and Microsoft records change over time; the analysis folder keeps the copy we used, with its SHA-256.

# 1. KEV pinned to the commit used (records version, download date and SHA-256)
node analyze.mjs download fee9528c7588002b356d4f3288834169677d207b
# 2. cve.org records and Microsoft (MSRC) bulletins, then the analysis (Node 22 or later, no dependencies)
node analyze.mjs fetch
node analyze.mjs
# 3. Article from results.json and check of every named CVE against cve.org
node build-article.mjs
node verify-cves.mjs

# KEV 2026.11.03 · SHA-256 0e7e91681f2207c7920a338f0d2b14c67933473ecf9550153627efaaba8d2e4c

The script, the results, the table of all 40 entries and the verification list are at astrum.company/research/2026-kev-microsoft.

Findings

1 · Windows drives the volume; SharePoint, the urgency

Windows and its components account for 17 entries (42.5%), 10 of them zero-days. SharePoint Server accounts for 8, all 2026 CVEs, with a different pattern: in 6 cases CISA confirmed exploitation after the patch was already out, and the median time from publication to KEV entry was 21.5 days. That margin only protects those who patch in time.

CISA set a 3-day remediation deadline for 7 of the 8 SharePoint entries and flagged 6 for forensic triage. 6 of those deadlines come from directive BOD 26-04, issued on June 10, 2026 for US federal systems; the other was set earlier, in March, under the previous directive, BOD 22-01. According to its implementation guidance, the KEV sets 3 days when the flaw is in a publicly exposed asset, its technical impact is total and exploitation is automatable, and forensic triage requires checking whether systems were compromised. It does not apply in Chile, but it signals urgency.

The same happens outside SharePoint with CVE-2026-33824, a remote code execution flaw in Windows Internet Key Exchange (IKE) Service Extensions: it was added to the KEV 126 days after publication, with a 3-day deadline.

2 · Zero-days: patch and exploitation arrived together

17 of the 40 entries (42.5%) were zero-days; among the 27 CVEs published in 2026, the share rises to 63%. 14 were published on a Patch Tuesday and 3 out of band: CVE-2026-21509 in Office (Word, PowerPoint, VBA), and CVE-2026-41091 and CVE-2026-45498 in Defender.

By type, zero-days are led by elevation of privilege (8) and security feature bypass (5). Neither is enough to get in on its own: the first gives more permissions to someone already running code on the machine, and the second gets around a security control. In these cases there was no margin between the patch and known exploitation.

3 · Ransomware used flaws that already had a patch

CISA flags 4 Microsoft entries (10%) with known use in ransomware campaigns, a share close to that of the whole catalog for the period (9.5%). None was a zero-day, and the median time from publication to KEV entry was 96.5 days:

• CVE-2023-21529 · Exchange Server. Remote code execution through deserialization; published in 2023, added to the KEV 1,154 days later.
• CVE-2025-60710 · Windows and its components. Elevation of privilege; published in 2025, added to the KEV 153 days later.
• CVE-2026-33825 · Defender. Elevation of privilege; published in 2026, added to the KEV 8 days later.
• CVE-2026-45659 · SharePoint Server. Remote code execution through deserialization; published in 2026, added to the KEV 40 days later.

In all 4 cases the patch was out before CISA confirmed exploitation. They were known flaws with a patch available.

4 · Old flaws are still on the list

8 entries are CVEs from 2015 or earlier: 3 in Office, 3 in Windows and 2 in Internet Explorer. The one with the lowest ID is CVE-2008-0015, in a Windows video ActiveX control; the first published on cve.org is CVE-2008-4250, on October 23, 2008. Among the 13 CVEs published before 2026, the median age at KEV entry was 16 years. CISA adding them now means it found evidence of exploitation, not when it happened.

5 · What kind of flaws

According to Microsoft's classification (32 entries; the 8 oldest have none): elevation of privilege (11), remote code execution (9), security feature bypass (6), spoofing (3), denial of service (2) and information disclosure (1). 5 are deserialization of untrusted data (CWE-502), all in SharePoint and Exchange. And 6 have a CVSS below 7: a "critical and high only" filter would have missed them.

What to patch first: checklist

1. Internet-facing servers: SharePoint, Exchange and AD FS. Apply their patches as soon as they are released, without waiting for the monthly cycle. If you cannot, remove internet access until patched and check for compromise, as CISA requires for entries flagged for forensic triage.
2. Patch Tuesday zero-days. On that same Tuesday, check which CVEs Microsoft's bulletin flags as exploited and prioritize those patches on Windows workstations and servers.
3. Out-of-band updates. 3 of the 17 zero-days arrived outside Patch Tuesday, 2 of them in Defender. Make sure the Defender antimalware platform is up to date on every device and follow Microsoft's out-of-band advisories.
4. Overdue patches. The 4 flaws used in ransomware had a patch before they entered the KEV. Look for Exchange or SharePoint servers and Windows machines that are months behind.
5. Legacy systems. Inventory machines with Internet Explorer, old Office versions or unsupported Windows. If they cannot be updated, isolate or retire them.
6. Match the KEV against your inventory regularly. CISA recommends that all organizations review and monitor the catalog; the frequency is up to you.

Limitations

• The KEV is a US government catalog: it includes what CISA confirms, not everything that is exploited.
• The KEV date added is not the date of first exploitation. Our zero-day criterion depends on dates: with one day of tolerance there would be 18, and for 4 CVEs the cve.org date differs from the first revision of Microsoft's bulletin.
• The "Exploited: Yes" flag is the current one in Microsoft's bulletin, and Microsoft may change its assessment after release. 20 entries carry it; 3 of them entered the KEV days after publication.
• An "unknown" ransomware flag in the KEV does not mean the flaw is not used in ransomware.
• KEV deadlines and directive BOD 26-04 bind only US federal agencies.

Sources

• CISA · Known Exploited Vulnerabilities Catalog (version 2026.11.03, file on GitHub).
• CISA · About the KEV catalog.
• CISA · BOD 26-04 and its implementation guidance.
• CVE Program · cve.org.
• Microsoft · MSRC CVRF API and Exploitability Index.
• Microsoft · Windows update release cycle.
• Astrum · script, results and verification for this analysis.

At Astrum, cybersecurity is our core line of work. If you want to match your Microsoft inventory against the KEV and decide what to patch first, let's talk.