Microsoft Windows 10 Version 1607 vulnerabilities

534 CVEs affecting Microsoft Windows 10 Version 1607, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-96914, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-83665, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
• CVE-2026-83655, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. Out-of-bounds read in Network Policy Server (NPS) allows an unauthorized attacker to deny service over a network.
• CVE-2026-70058, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.2% chance of exploitation in the next 30 days. Out-of-bounds write in Windows DHCP Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-96866, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
• CVE-2026-96861, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Out-of-bounds read in Network Device Enrollment Service (NDES) allows an unauthorized attacker to deny service over a network.
• CVE-2026-84017, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Null pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
• CVE-2026-83860, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Stack-based buffer overflow in Windows GDI allows an unauthorized attacker to deny service over a network.
• CVE-2026-83843, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
• CVE-2026-83795, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.
• CVE-2026-70133, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.

Latest

• CVE-2026-96914, published 2026-10-13. High severity, CVSS 8.8. EPSS: 0.3% chance of exploitation in the next 30 days. Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
• CVE-2026-96911, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
• CVE-2026-96910, published 2026-10-13. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Untrusted pointer dereference in Microsoft Windows Search Component allows an authorized attacker to disclose information locally.
• CVE-2026-96867, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Out-of-bounds read in Windows NTFS allows an authorized attacker to execute code locally.
• CVE-2026-96865, published 2026-10-13. Medium severity, CVSS 5.6. EPSS: 0.4% chance of exploitation in the next 30 days. Exposure of sensitive system information to an unauthorized control sphere in Windows Secure Kernel Mode allows an authorized attacker to disclose information locally.
• CVE-2026-96864, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 0.6% chance of exploitation in the next 30 days. Double free in Microsoft Failover Cluster Virtual Driver allows an unauthorized attacker to execute code over a network.
• CVE-2026-96862, published 2026-10-13. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Out-of-bounds read in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.
• CVE-2026-96860, published 2026-10-13. Medium severity, CVSS 5.5. EPSS: 0.4% chance of exploitation in the next 30 days. Out-of-bounds read in Windows USB Print Driver allows an authorized attacker to disclose information locally.