M365 Change Tracker

← Home

Exploited Microsoft 365 CVEs (2)

Vulnerabilities affecting Microsoft 365 / Office that are actively exploited, per CISA's Known Exploited Vulnerabilities catalog.

See also: Retirements · Breaking & API

ImportantExploitedOn-premWindows ServerWindows 10 VersionWindows 10 Version 21H2 for 32-bit Systems

Windows Shell Security Feature Bypass Vulnerability

⏰ Remediate by Oct 16, 2026 · passed 27d ago

Security Feature Bypass · Important · CVSS 8.8 · Exploited in the wild. Affects: Windows Server, Windows 10 Version, Windows 10 Version 21H2 for 32-bit Systems, Windows 10 Version 21H2 for ARM64-based Systems, Windows 10 Version 21H2 for x64-based Systems, Windows 10 Version 22H2 for 32-bit Systems.

ModerateExploitedCloud + on-premMicrosoft Office LTSCMicrosoft 365 Apps

Microsoft Outlook Spoofing Vulnerability

⏰ Remediate by Nov 24, 2026 · in 12d

Spoofing · Moderate · CVSS 6.5 · Exploited in the wild. Affects: Microsoft Office LTSC, Microsoft 365 Apps.