Microsoft Windows 11 22h2 vulnerabilities

1,652 CVEs affecting Microsoft Windows 11 22h2, 74 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-50508, published 2026-06-09.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2023-44487: HTTP/2 Rapid Reset Attack Vulnerability, published 2023-10-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-10-10. EPSS: 100% chance of exploitation in the next 30 days. The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
• CVE-2021-34527: Microsoft Windows Print Spooler Remote Code Execution Vulnerability, published 2021-07-02. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.8% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run…
• CVE-2024-21412: Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability, published 2024-02-13. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2024-02-13. EPSS: 99.4% chance of exploitation in the next 30 days. Internet Shortcut Files Security Feature Bypass Vulnerability
• CVE-2023-36884: Microsoft Windows Search Remote Code Execution Vulnerability, published 2023-07-11. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2023-07-17. EPSS: 98.9% chance of exploitation in the next 30 days. Windows Search Remote Code Execution Vulnerability
• CVE-2023-36025: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability, published 2023-11-14. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-11-14. EPSS: 88.1% chance of exploitation in the next 30 days. Windows SmartScreen Security Feature Bypass Vulnerability
• CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability, published 2025-06-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-06-10. EPSS: 87% chance of exploitation in the next 30 days. External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
• CVE-2024-43451: Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability, published 2024-11-12. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2024-11-12. EPSS: 85.4% chance of exploitation in the next 30 days. NTLM Hash Disclosure Spoofing Vulnerability
• CVE-2024-38112: Microsoft Windows MSHTML Platform Spoofing Vulnerability, published 2024-07-09. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2024-07-09. EPSS: 84.2% chance of exploitation in the next 30 days. Windows MSHTML Platform Spoofing Vulnerability
• CVE-2025-33073: Microsoft Windows SMB Client Improper Access Control Vulnerability, published 2025-06-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-10-20. EPSS: 82.7% chance of exploitation in the next 30 days. Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
• CVE-2023-24880: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability, published 2023-03-14. Medium severity, CVSS 4.4. Actively exploited: in CISA KEV since 2023-03-14. EPSS: 78% chance of exploitation in the next 30 days. Windows SmartScreen Security Feature Bypass Vulnerability

Latest

• CVE-2026-50508, published 2026-06-09. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-64680, published 2025-12-09. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
• CVE-2025-64679, published 2025-12-09. High severity, CVSS 7.8. EPSS: 0.5% chance of exploitation in the next 30 days. Heap-based buffer overflow in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
• CVE-2025-62209, published 2025-11-11. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.
• CVE-2025-62208, published 2025-11-11. Medium severity, CVSS 5.5. EPSS: 0.6% chance of exploitation in the next 30 days. Insertion of sensitive information into log file in Windows License Manager allows an authorized attacker to disclose information locally.
• CVE-2025-59502, published 2025-10-14. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Uncontrolled resource consumption in Windows Remote Procedure Call allows an unauthorized attacker to deny service over a network.
• CVE-2025-59295, published 2025-10-14. High severity, CVSS 8.8. EPSS: 1.9% chance of exploitation in the next 30 days. Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network.
• CVE-2025-59294, published 2025-10-14. Medium severity, CVSS 4.6. EPSS: 0.6% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical attack.
• CVE-2025-59290, published 2025-10-14. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
• CVE-2025-59289, published 2025-10-14. High severity, CVSS 7.0. EPSS: 0.2% chance of exploitation in the next 30 days. Double free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.