Playbooks / Dashboards

Microsoft label vs. reality

Microsoft tags many CVEs "Remote Code Execution", but plenty of them need a victim to open a file, connect to a bad server or already have local access. This dashboard re-sorts every CVE in Microsoft's Security Update Guide by what an attacker really needs, using Microsoft's own CVSS vector and FAQ text. Data: MSRC CVRF API joined with CISA KEV (catalog 2026.10.14). Generated 2026-10-15T11:37:45Z. Inspired by Daniel Card's (@uk_daniel_card) MS CVE analysis; this is an independent implementation.

Microsoft's label vs. realistic attack class

Click a number to list those CVEs. A CVE with two impact labels across products counts once, under its most common label.

Realistic attack class vs. Microsoft severity

CVE list

How we classify

1. Rules run top to bottom; the first match wins. Inputs: Microsoft's CVSS 3.x vector, FAQ text (HTML stripped), product/component and title.
2. Physical: AV:P.
3. No CVSS vector: MSRC published no vector.
4. Guest-to-host (VM escape): S:C and (component/title mentions Hyper-V, or FAQ mentions guest/host/virtual machine escape).
5. Malicious file: Preview Pane is enough: FAQ states the Preview Pane IS an attack vector (answers like 'No, the Preview Pane is not an attack vector' are ignored).
6. User connects to a malicious server: FAQ says the victim/client connects to an attacker-controlled or malicious server (e.g. RDP client, SMB/SQL client, 'malicious server').
7. Zero-click network: AV:N, PR:N, UI:N.
8. Network: authenticated: AV:N with PR:L or PR:H and UI:N.
9. Adjacent network: AV:A.
10. Web content / browser: UI:R and (product is Edge/browser or FAQ mentions visiting/clicking a website, link or specially crafted web page/URL).
11. Malicious file: user must open it: UI:R and FAQ mentions opening a file/document/attachment; or AV:L with MS label Remote Code Execution (Microsoft's own note that 'Remote' refers to the attacker's location while the code runs locally after a file is opened).
12. Other user interaction required: any remaining UI:R.
13. Local attacker: remaining AV:L.
14. Anything left (e.g. AV:N/UI:N not covered) falls to Other user interaction / local only per vector; nothing is invented.
15. Overstated RCE = Microsoft labels it Remote Code Execution but our class is not zero-click network.

Caveats

• We trust Microsoft's own CVSS vector and FAQ. Where those are wrong or vague, our class is too. FAQ wording varies, so the text rules are keyword rules and will misfile some CVEs. Check the MSRC page before acting.
• When a CVE has several CVSS vectors (one per product), we use the highest-scoring one.
• Each CVE is counted once, in the first monthly CVRF document (from 2026-01) that lists it. MSRC documents also list third-party CNA CVEs (Linux kernel, Azure Linux/Mariner open-source packages, Chromium etc.); filter cna=Microsoft for Microsoft-issued CVEs.
• Totals include ADV advisories and later re-releases that MSRC files under that month, so they won't match Patch Tuesday headline counts exactly.
• "Exploited" is Microsoft's flag (Exploited:Yes); "On KEV" is CISA's catalog.

Agents: /api/ms-label-reality.json (full per-CVE records and rules, no auth). Rebuilt when ctxsec refreshes (data at most 12h old).