Microsoft OneDrive vulnerabilities

15 CVEs affecting Microsoft OneDrive, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-65680, published 2026-08-11.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2018-0593, published 2018-06-26. High severity, CVSS 7.8. EPSS: 5.6% chance of exploitation in the next 30 days. Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
• CVE-2018-0592, published 2018-06-26. High severity, CVSS 7.8. EPSS: 5.6% chance of exploitation in the next 30 days. Untrusted search path vulnerability in Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.
• CVE-2020-0654, published 2020-01-14. Critical severity, CVSS 9.1. EPSS: 3.5% chance of exploitation in the next 30 days. A security feature bypass vulnerability exists in Microsoft OneDrive App for Android.This could allow an attacker to bypass the passcode or fingerprint requirements of the App.The security update…
• CVE-2023-24890, published 2023-03-14. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
• CVE-2020-16853, published 2020-09-11. High severity, CVSS 7.1. EPSS: 1% chance of exploitation in the next 30 days. <p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An attacker who successfully exploited this vulnerability could…
• CVE-2020-16851, published 2020-09-11. High severity, CVSS 7.1. EPSS: 1% chance of exploitation in the next 30 days. <p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An attacker who successfully exploited this vulnerability could…
• CVE-2020-16852, published 2020-09-11. High severity, CVSS 7.1. EPSS: 0.9% chance of exploitation in the next 30 days. <p>An elevation of privilege vulnerability exists when the OneDrive for Windows Desktop application improperly handles symbolic links. An attacker who successfully exploited this vulnerability could…
• CVE-2025-60722, published 2025-11-11. Medium severity, CVSS 6.5. EPSS: 0.9% chance of exploitation in the next 30 days. Improper limitation of a pathname to a restricted directory ('path traversal') in OneDrive for Android allows an authorized attacker to elevate privileges over a network.
• CVE-2020-1465, published 2020-07-14. High severity, CVSS 7.8. EPSS: 0.9% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Microsoft OneDrive that allows file deletion in arbitrary locations.To exploit the vulnerability, an attacker would first have to log on to the…
• CVE-2023-24923, published 2023-03-14. Medium severity, CVSS 5.5. EPSS: 0.8% chance of exploitation in the next 30 days. Microsoft OneDrive for Android Information Disclosure Vulnerability

Latest

• CVE-2026-65680, published 2026-08-11. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. Improper link resolution before file access ('link following') in Microsoft OneDrive allows an authorized attacker to elevate privileges locally.
• CVE-2023-24930, published 2023-03-14. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Microsoft OneDrive for MacOS Elevation of Privilege Vulnerability
• CVE-2023-24882, published 2023-03-14. Medium severity, CVSS 5.5. EPSS: 0.7% chance of exploitation in the next 30 days. Microsoft OneDrive for Android Information Disclosure Vulnerability
• CVE-2022-23255, published 2022-02-09. Medium severity, CVSS 5.9. EPSS: 0.6% chance of exploitation in the next 30 days. Microsoft OneDrive for Android Security Feature Bypass Vulnerability