Microsoft Windows 8.1 vulnerabilities

2,215 CVEs affecting Microsoft Windows 8.1, 94 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2022-35759, published 2023-05-31.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2015-1635: Microsoft HTTP.sys Remote Code Execution Vulnerability, published 2015-04-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-02-10. EPSS: 100% chance of exploitation in the next 30 days. HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via crafted HTTP…
CVE-2017-0147: Microsoft Windows SMBv1 Information Disclosure Vulnerability, published 2017-03-17. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-05-24. EPSS: 99.7% chance of exploitation in the next 30 days. The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gold, 1511, and 1607;…
CVE-2022-30190: Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability, published 2022-06-01. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-06-14. EPSS: 99.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run…
CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability, published 2021-09-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.8% chance of exploitation in the next 30 days. Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability…
CVE-2014-6332: Microsoft Windows Object Linking & Embedding (OLE) Automation Array Remote Code Execution Vulnerability, published 2014-11-11. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 94.9% chance of exploitation in the next 30 days. OleAut32.dll in OLE in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT…
CVE-2017-8464: Microsoft Windows Shell (.lnk) Remote Code Execution Vulnerability, published 2017-06-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-02-10. EPSS: 90% chance of exploitation in the next 30 days. Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, 1703, and Windows…
CVE-2018-8174: Microsoft Windows VBScript Engine Out-of-Bounds Write Vulnerability, published 2018-05-09. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-02-15. EPSS: 88.3% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7,…
CVE-2014-6324: Microsoft Kerberos Key Distribution Center (KDC) Privilege Escalation Vulnerability, published 2014-11-18. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 87.3% chance of exploitation in the next 30 days. The Kerberos Key Distribution Center (KDC) in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, and Windows Server 2012…
CVE-2014-4113: Microsoft Win32k Privilege Escalation Vulnerability, published 2014-10-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-05-04. EPSS: 86.9% chance of exploitation in the next 30 days. win32k.sys in the kernel-mode drivers in Microsoft Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and…
CVE-2015-2426: Microsoft Windows Adobe Type Manager Library Remote Code Execution Vulnerability, published 2015-07-20. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 86.6% chance of exploitation in the next 30 days. Buffer underflow in atmfd.dll in the Windows Adobe Type Manager Library in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012…

Latest

CVE-2022-35759, published 2023-05-31. Medium severity, CVSS 6.5. EPSS: 1.7% chance of exploitation in the next 30 days. Windows Local Security Authority (LSA) Denial of Service Vulnerability
CVE-2022-35758, published 2023-05-31. Medium severity, CVSS 5.5. EPSS: 0.5% chance of exploitation in the next 30 days. Windows Kernel Memory Information Disclosure Vulnerability
CVE-2022-35756, published 2023-05-31. High severity, CVSS 7.8. EPSS: 11.3% chance of exploitation in the next 30 days. Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-35755, published 2023-05-31. High severity, CVSS 7.3. EPSS: 9.8% chance of exploitation in the next 30 days. Windows Print Spooler Elevation of Privilege Vulnerability
CVE-2022-35754, published 2023-05-31. Medium severity, CVSS 6.7. EPSS: 0.4% chance of exploitation in the next 30 days. Unified Write Filter Elevation of Privilege Vulnerability
CVE-2022-35753, published 2023-05-31. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-35752, published 2023-05-31. High severity, CVSS 8.1. EPSS: 1.2% chance of exploitation in the next 30 days. Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
CVE-2022-35751, published 2023-05-31. High severity, CVSS 7.8. EPSS: 5.5% chance of exploitation in the next 30 days. Windows Hyper-V Elevation of Privilege Vulnerability
CVE-2022-35750, published 2023-05-31. High severity, CVSS 7.8. EPSS: 6.5% chance of exploitation in the next 30 days. Win32k Elevation of Privilege Vulnerability
CVE-2022-35749, published 2023-05-31. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Windows Digital Media Receiver Elevation of Privilege Vulnerability