Microsoft Bing vulnerabilities
8 CVEs affecting Microsoft Bing, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-45650, published 2026-06-09.
More from Microsoft.
Highest priority
Known exploited (CISA KEV) first, then by EPSS exploit probability.
- CVE-2014-1670, published 2014-01-25. Medium severity, CVSS 6.8. EPSS: 13.7% chance of exploitation in the next 30 days. The Microsoft Bing application before 4.2.1 for Android allows remote attackers to install arbitrary APK files via vectors involving a crafted DNS response.
- CVE-2020-1329, published 2020-06-09. Medium severity, CVSS 6.5. EPSS: 2.6% chance of exploitation in the next 30 days. A spoofing vulnerability exists when Microsoft Bing Search for Android improperly handles specific HTML content, aka 'Microsoft Bing Search Spoofing Vulnerability'.
- CVE-2021-33753, published 2021-07-14. Medium severity, CVSS 4.7. EPSS: 1.9% chance of exploitation in the next 30 days. Microsoft Bing Search Spoofing Vulnerability
- CVE-2025-21355, published 2025-02-19. Critical severity, CVSS 9.8. EPSS: 1.7% chance of exploitation in the next 30 days. Missing Authentication for Critical Function in Microsoft Bing allows an unauthorized attacker to execute code over a network
- CVE-2026-33819, published 2026-04-23. Critical severity, CVSS 9.8. EPSS: 1.5% chance of exploitation in the next 30 days. Deserialization of untrusted data in Microsoft Bing allows an unauthorized attacker to execute code over a network.
- CVE-2026-32186, published 2026-04-03. Critical severity, CVSS 9.8. EPSS: 0.9% chance of exploitation in the next 30 days. Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to elevate privileges over a network.
- CVE-2026-26120, published 2026-03-19. High severity, CVSS 7.5. EPSS: 0.8% chance of exploitation in the next 30 days. Server-side request forgery (ssrf) in Microsoft Bing allows an unauthorized attacker to perform tampering over a network.
- CVE-2026-45650, published 2026-06-09. Medium severity, CVSS 4.3. EPSS: 0.7% chance of exploitation in the next 30 days. User interface (ui) misrepresentation of critical information in Microsoft Bing allows an unauthorized attacker to perform spoofing over a network.