Microsoft Surface Go 2 1901 Firmware — known CVE vulnerabilities

Every CVE whose affected-product data names Microsoft Surface Go 2 1901 Firmware, ordered by CVSS severity, with EPSS exploit prediction and CISA KEV status.

CVEs (2)

• CVE-2026-48581 — CVSS 7.8 (high): Insufficient granularity of access control in Microsoft Surface allows an authorized attacker to elevate privileges locally.
• CVE-2025-21194 — CVSS 7.1 (high): Microsoft Surface Security Feature Bypass Vulnerability