Microsoft Windows 7 vulnerabilities

2,367 CVEs affecting Microsoft Windows 7, 100 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2023-34367, published 2023-06-14.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2019-0708: Microsoft Remote Desktop Services Remote Code Execution Vulnerability, published 2019-05-16. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 100% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP and sends…
CVE-2015-1635: Microsoft HTTP.sys Remote Code Execution Vulnerability, published 2015-04-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-02-10. EPSS: 100% chance of exploitation in the next 30 days. HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP…
CVE-2017-0147: Microsoft Windows SMBv1 Information Disclosure Vulnerability, published 2017-03-17. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-05-24. EPSS: 99.7% chance of exploitation in the next 30 days. The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;…
CVE-2017-0199: Microsoft Office and WordPad Remote Code Execution Vulnerability, published 2017-04-12. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.5% chance of exploitation in the next 30 days. Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows 8.1 allow remote…
CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability, published 2022-06-01. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-14. EPSS: 99.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run…
CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability, published 2021-09-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.8% chance of exploitation in the next 30 days. Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability…
CVE-2014-6332: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability, published 2014-11-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 94.9% chance of exploitation in the next 30 days. OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT…
CVE-2010-2568: Microsoft Windows Remote Code Execution Vulnerability, published 2010-07-22. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-09-15. EPSS: 91.3% chance of exploitation in the next 30 days. Windows Shell in Microsoft Windows XP SP3, Server 2003 SP2, Vista SP1 and SP2, Server 2008 SP2 and R2, and Windows 7 allows local users or remote attackers to execute arbitrary code via a crafted (1)…
CVE-2017-8464: Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability, published 2017-06-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-02-10. EPSS: 90% chance of exploitation in the next 30 days. Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows…
CVE-2018-8174: Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability, published 2018-05-09. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-02-15. EPSS: 88.3% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7,…

Latest

CVE-2023-34367, published 2023-06-14. Medium severity, CVSS 6.5. EPSS: 1.2% chance of exploitation in the next 30 days. Windows 7 is vulnerable to a full blind TCP/IP hijacking attack. The vulnerability exists in Windows 7 (any Windows until Windows 8) and in any implementation of TCP/IP, which is vulnerable to the…
CVE-2022-35759, published 2023-05-31. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. Windows Local Security Authority (LSA) Denial of Service Vulnerability
CVE-2022-35758, published 2023-05-31. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Windows Kernel Memory Information Disclosure Vulnerability
CVE-2022-35756, published 2023-05-31. High severity, CVSS 7.8. EPSS: 11.3% chance of exploitation in the next 30 days. Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-35754, published 2023-05-31. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. Unified Write Filter Elevation of Privilege Vulnerability
CVE-2022-35753, published 2023-05-31. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-35752, published 2023-05-31. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-35751, published 2023-05-31. High severity, CVSS 7.8. EPSS: 5.5% chance of exploitation in the next 30 days. Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2022-35750, published 2023-05-31. High severity, CVSS 7.8. EPSS: 6.5% chance of exploitation in the next 30 days. Win32k Elevation of Privilege Vulnerability
CVE-2022-35747, published 2023-05-31. Medium severity, CVSS 5.9. EPSS: 1.7% chance of exploitation in the next 30 days. Windows Point-to-Point Protocol (PPP) Denial of Service Vulnerability