Microsoft Internet Explorer known exploited vulnerabilities, ranked
CISA lists 36 Microsoft Internet Explorer CVEs as exploited in the wild. 3 were added in the last 12 months and 6 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2010-3962: EPSS 96.8%, added 2025-10-06
- CVE-2016-0189: EPSS 94.1%, used in ransomware, added 2022-03-28
- CVE-2010-0249: EPSS 91.9%, added 2026-05-20
- CVE-2013-3893: EPSS 87.5%, added 2025-08-12
- CVE-2020-0674: EPSS 86.9%, added 2021-11-03
All 36 Microsoft Internet Explorer CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2010-3962 | Internet Explorer Uninitialized Memory Corruption | 96.8% | – | 2025-10-06 | 2025-10-27 |
| 2 | CVE-2016-0189 | Internet Explorer Memory Corruption | 94.1% | Yes | 2022-03-28 | 2022-04-18 |
| 3 | CVE-2010-0249 | Internet Explorer Use-After-Free | 91.9% | – | 2026-05-20 | 2026-06-03 |
| 4 | CVE-2013-3893 | Internet Explorer Resource Management Errors | 87.5% | – | 2025-08-12 | 2025-09-02 |
| 5 | CVE-2020-0674 | Internet Explorer Scripting Engine Memory Corruption | 86.9% | – | 2021-11-03 | 2022-05-03 |
| 6 | CVE-2014-0322 | Internet Explorer Use-After-Free | 85.1% | – | 2022-05-04 | 2022-05-25 |
| 7 | CVE-2014-1776 | Internet Explorer Memory Corruption | 82.7% | – | 2022-01-28 | 2022-07-28 |
| 8 | CVE-2010-0806 | Internet Explorer Use-After-Free | 82.2% | – | 2026-05-20 | 2026-06-03 |
| 9 | CVE-2019-0752 | Internet Explorer Type Confusion | 81.6% | Yes | 2022-02-15 | 2022-08-15 |
| 10 | CVE-2021-26411 | Internet Explorer Memory Corruption | 80.8% | Yes | 2021-11-03 | 2021-11-17 |
| 11 | CVE-2012-4969 | Internet Explorer Use-After-Free | 80.2% | – | 2022-06-08 | 2022-06-22 |
| 12 | CVE-2012-4792 | Internet Explorer Use-After-Free | 78.8% | – | 2024-07-23 | 2024-08-13 |
| 13 | CVE-2013-1347 | Internet Explorer Remote Code Execution | 77.7% | – | 2022-03-03 | 2022-03-24 |
| 14 | CVE-2013-3897 | Internet Explorer Use-After-Free | 77.3% | – | 2022-03-03 | 2022-03-24 |
| 15 | CVE-2019-1429 | Internet Explorer Scripting Engine Memory Corruption | 77.3% | – | 2021-11-03 | 2022-05-03 |
| 16 | CVE-2013-2551 | Internet Explorer Use-After-Free | 73.9% | Yes | 2022-03-28 | 2022-04-18 |
| 17 | CVE-2013-3163 | Internet Explorer Memory Corruption | 70.7% | – | 2023-03-30 | 2023-04-20 |
| 18 | CVE-2017-0059 | Internet Explorer Information Disclosure | 62.0% | – | 2022-03-28 | 2022-04-18 |
| 19 | CVE-2015-2419 | Internet Explorer Memory Corruption | 53.1% | – | 2022-03-28 | 2022-04-18 |
| 20 | CVE-2019-1367 | Internet Explorer Scripting Engine Memory Corruption | 52.4% | Yes | 2021-11-03 | 2022-05-03 |
| 21 | CVE-2015-2502 | Internet Explorer Memory Corruption | 51.0% | – | 2022-04-13 | 2022-05-04 |
| 22 | CVE-2013-7331 | Internet Explorer Information Disclosure | 50.2% | – | 2022-05-25 | 2022-06-15 |
| 23 | CVE-2014-4123 | Internet Explorer Privilege Escalation | 47.1% | – | 2022-05-25 | 2022-06-15 |
| 24 | CVE-2015-2425 | Internet Explorer Memory Corruption | 44.7% | – | 2022-05-25 | 2022-06-15 |
| 25 | CVE-2015-0071 | Internet Explorer ASLR Bypass | 33.6% | – | 2022-05-25 | 2022-06-15 |
| 26 | CVE-2016-3298 | Internet Explorer Messaging API Information Disclosure | 33.3% | – | 2022-05-24 | 2022-06-14 |
| 27 | CVE-2020-0968 | Internet Explorer Scripting Engine Memory Corruption | 30.7% | Yes | 2021-11-03 | 2022-05-03 |
| 28 | CVE-2017-0222 | Internet Explorer Remote Code Execution | 29.6% | – | 2022-02-25 | 2022-08-25 |
| 29 | CVE-2018-8653 | Internet Explorer Scripting Engine Memory Corruption | 29.6% | – | 2021-11-03 | 2022-05-03 |
| 30 | CVE-2017-0149 | Internet Explorer Memory Corruption | 29.2% | – | 2022-05-24 | 2022-06-14 |
| 31 | CVE-2014-2817 | Internet Explorer Privilege Escalation | 26.3% | – | 2022-05-25 | 2022-06-15 |
| 32 | CVE-2020-1380 | Internet Explorer Scripting Engine Memory Corruption | 24.2% | – | 2021-11-03 | 2022-05-03 |
| 33 | CVE-2017-0210 | Internet Explorer Privilege Escalation | 22.3% | – | 2022-05-24 | 2022-06-14 |
| 34 | CVE-2016-0162 | Internet Explorer Information Disclosure | 22.0% | – | 2022-05-24 | 2022-06-14 |
| 35 | CVE-2019-0676 | Internet Explorer Information Disclosure | 8.1% | – | 2022-05-23 | 2022-06-13 |
| 36 | CVE-2021-27085 | Internet Explorer Remote Code Execution | 5.4% | – | 2021-11-03 | 2021-11-17 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Microsoft KEV CVEs · other Microsoft products: SharePoint · Windows · SharePoint Server · Defender · Office · Exchange Server · Win32k · free KEV badge for Microsoft · all vendors