Microsoft Office Online Server

Name: Microsoft Office Online Server
Brand: Microsoft

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

11critical144high88medium5low

updated 2026-10-28

vulnerabilities (569)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2025-49704US	—OT critical	100.0% (100th)	KEV	no fix	2025-07-08	≤ vers:unknown/1.0.0\|<16.0.10417.20027
CVE-2025-49706US	—OT critical	99.1% (100th)	KEV	no fix	2025-07-08	≤ vers:unknown/1.0.0\|<16.0.10417.20027
CVE-2026-55040US	—OT critical	69.5% (99th)	KEV	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-32201US	medium6.5OT critical	43.4% (99th)	KEV	no fix	2026-04-14	≤ vers:unknown/*
CVE-2026-50522US	—OT critical	3.04% (87th)	KEV	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-56164US	critical9.8OT critical	1.01% (63rd)	KEV	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-20963US	—OT critical	29.2% (98th)	KEV	no fix	2026-01-13	≤ vers:unknown/*
CVE-2026-58644US	—OT critical	15.9% (97th)	KEV	no fix	2026-07-14	≤ vers:unknown/*
CVE-2026-96951US	high8.8OT critical	9.81% (96th)	KEV	no fix	2026-10-13	≤ vers:unknown/*
CVE-2025-54897US	—	21.7% (98th)	Exploit	no fix	2025-09-09	≤ vers:unknown/*
CVE-2025-47166US	—	21.6% (98th)	Exploit	no fix	2025-06-10	≤ vers:unknown/1.0.0\|<16.0.10417.20018
CVE-2026-26114US	—	3.15% (88th)	Exploit	no fix	2026-03-10	≤ vers:unknown/*
CVE-2025-27751US	—	2.48% (85th)	Exploit	16.0.10417.20003	2025-04-08	16.0.0.0 → 16.0.10417.20003
CVE-2025-47175US	—	2.39% (84th)	Exploit	no fix	2025-06-10	≤ vers:unknown/1.0.0\|<16.0.10417.20018
CVE-2025-47165US	—	2.19% (82nd)	Exploit	16.0.10417.20018	2025-06-10	2 versions
CVE-2025-47171US	—	1.68% (77th)	Exploit	no fix	2025-06-10	≤ vers:unknown/1.0.0\|<16.0.10417.20018
CVE-2025-47957US	—	1.31% (71st)	Exploit	no fix	2025-06-10	≤ vers:unknown/1.0.0\|<16.0.10417.20018
CVE-2025-47176US	—	0.75% (55th)	Exploit	no fix	2025-06-10	≤ vers:unknown/1.0.0\|<16.0.10417.20018
CVE-2026-45484US	—	35.2% (98th)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2026-33112US	—	31.1% (98th)	—	no fix	2026-05-12	≤ vers:unknown/*
CVE-2025-47163US	—	20.9% (98th)	—	no fix	2025-06-10	≤ vers:unknown/1.0.0\|<16.0.10417.20018
CVE-2019-1331US	high8.8	19.7% (97th)	—	no fix	2019-10-10	≤ unspecified
CVE-2026-20945US	medium5.4	19.1% (97th)	—	no fix	2026-04-14	≤ vers:unknown/*
CVE-2026-20947US	—	18.4% (97th)	—	no fix	2026-01-13	≤ vers:unknown/*
CVE-2018-8628US	high7.8	15.9% (97th)	—	no fix	2018-12-12	≤ Office Online Server
CVE-2021-31939US	medium6.8	13.3% (96th)	—	16.0.10375.20000	2021-06-08	https://aka.ms/OfficeSecurityReleases → 16.0.10375.20000
CVE-2026-20959US	medium5.4	7.68% (95th)	—	no fix	2026-01-13	≤ vers:unknown/*
CVE-2025-60724US	—	6.29% (94th)	—	no fix	2025-11-11	≤ vers:unknown/*
CVE-2026-40364US	—	4.42% (91st)	—	no fix	2026-05-12	≤ vers:unknown/*
CVE-2020-1495US	high8.8	4.21% (91st)	—	publication	2020-08-17	https://aka.ms/OfficeSecurityReleases → publication
CVE-2020-17123US	high9.3	3.59% (89th)	—	publication	2020-12-10	1.0.0 → publication
CVE-2025-47994US	high8.6	3.28% (88th)	—	no fix	2025-07-08	≤ vers:unknown/1.0.0\|<16.0.10417.20027
CVE-2021-24069US	medium6.8	2.49% (85th)	—	publication	2021-02-25	https://aka.ms/OfficeSecurityReleases → publication
CVE-2021-24070US	medium6.8	2.48% (84th)	—	publication	2021-02-25	https://aka.ms/OfficeSecurityReleases → publication
CVE-2021-24067US	medium6.8	2.48% (84th)	—	publication	2021-02-25	https://aka.ms/OfficeSecurityReleases → publication
CVE-2025-59237US	—	2.46% (84th)	—	no fix	2025-10-14	≤ vers:unknown/*
CVE-2025-62204US	—	2.21% (82nd)	—	no fix	2025-11-11	≤ vers:unknown/*
CVE-2021-43256US	high7.8	2.18% (82nd)	—	16.0.10381.20001	2021-12-15	https://aka.ms/OfficeSecurityReleases → 16.0.10381.20001
CVE-2024-30042US	—	2.14% (82nd)	—	16.0.10410.20003	2024-05-14	https://aka.ms/OfficeSecurityReleases → 16.0.10410.20003
CVE-2026-35439US	—	2.03% (81st)	—	no fix	2026-05-12	≤ vers:unknown/*
CVE-2026-33110US	—	1.97% (80th)	—	no fix	2026-05-12	≤ vers:unknown/*
CVE-2026-40368US	—	1.82% (79th)	—	no fix	2026-05-12	≤ vers:unknown/*
CVE-2025-47172US	—	1.75% (78th)	—	no fix	2025-06-10	≤ vers:unknown/1.0.0\|<16.0.10417.20018
CVE-2026-40357US	—	1.70% (77th)	—	no fix	2026-05-12	≤ vers:unknown/*
CVE-2026-45454US	high8.8	1.63% (76th)	—	no fix	2026-06-09	≤ vers:unknown/*
CVE-2026-70242US	critical9.8	1.57% (75th)	—	no fix	2026-10-13	≤ vers:unknown/*
CVE-2026-85900US	high8.8	1.52% (74th)	—	no fix	2026-10-13	≤ vers:unknown/*
CVE-2026-26106US	—	1.46% (73rd)	—	no fix	2026-03-10	≤ vers:unknown/*
CVE-2025-59228US	—	1.36% (72nd)	—	no fix	2025-10-14	≤ vers:unknown/*
CVE-2026-70291US	critical9.8	1.33% (71st)	—	no fix	2026-10-13	≤ vers:unknown/*

showing 50 of 569

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-122Heap-based Buffer Overflow130 CVEs
CWE-416Use After Free116 CVEs
CWE-125Out-of-bounds Read84 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')37 CVEs
CWE-822Untrusted Pointer Dereference26 CVEs
CWE-121Stack-based Buffer Overflow21 CVEs
CWE-20Improper Input Validation20 CVEs
CWE-502Deserialization of Untrusted Data20 CVEs

sources (3)

Which sources assert this record, and when.

NLNCSC-NL (CSAF)499 CVEs
EUEU Vulnerability Database (ENISA)151 CVEs
USMicrosoft MSRC (CSAF)147 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan