Microsoft Windows 11 23h2 vulnerabilities

2,704 CVEs affecting Microsoft Windows 11 23h2, 64 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97844, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2024-21412: Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability, published 2024-02-13. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2024-02-13. EPSS: 99.4% chance of exploitation in the next 30 days. Internet Shortcut Files Security Feature Bypass Vulnerability
• CVE-2023-36025: Microsoft Windows SmartScreen Security Feature Bypass Vulnerability, published 2023-11-14. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2023-11-14. EPSS: 88.1% chance of exploitation in the next 30 days. Windows SmartScreen Security Feature Bypass Vulnerability
• CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability, published 2025-06-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-06-10. EPSS: 87% chance of exploitation in the next 30 days. External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
• CVE-2024-43451: Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability, published 2024-11-12. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2024-11-12. EPSS: 85.4% chance of exploitation in the next 30 days. NTLM Hash Disclosure Spoofing Vulnerability
• CVE-2024-38112: Microsoft Windows MSHTML Platform Spoofing Vulnerability, published 2024-07-09. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2024-07-09. EPSS: 84.2% chance of exploitation in the next 30 days. Windows MSHTML Platform Spoofing Vulnerability
• CVE-2025-33073: Microsoft Windows SMB Client Improper Access Control Vulnerability, published 2025-06-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-10-20. EPSS: 82.7% chance of exploitation in the next 30 days. Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
• CVE-2024-30088: Microsoft Windows Kernel TOCTOU Race Condition Vulnerability, published 2024-06-11. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2024-10-15. EPSS: 68.2% chance of exploitation in the next 30 days. Windows Kernel Elevation of Privilege Vulnerability
• CVE-2024-43572: Microsoft Windows Management Console Remote Code Execution Vulnerability, published 2024-10-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-10-08. EPSS: 66.7% chance of exploitation in the next 30 days. Microsoft Management Console Remote Code Execution Vulnerability
• CVE-2025-24054: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability, published 2025-03-11. Medium severity, CVSS 5.4. Actively exploited: in CISA KEV since 2025-04-17. EPSS: 62.3% chance of exploitation in the next 30 days. External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
• CVE-2024-21338: Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability, published 2024-02-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-03-04. EPSS: 59.8% chance of exploitation in the next 30 days. Windows Kernel Elevation of Privilege Vulnerability

Latest

• CVE-2026-97844, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97843, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97842, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97841, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97840, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97839, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97838, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97837, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97836, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97835, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.