Microsoft Windows 11 24h2 vulnerabilities

2,827 CVEs affecting Microsoft Windows 11 24h2, 49 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97844, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability, published 2025-06-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-06-10. EPSS: 87% chance of exploitation in the next 30 days. External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
• CVE-2024-43451: Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability, published 2024-11-12. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2024-11-12. EPSS: 85.4% chance of exploitation in the next 30 days. NTLM Hash Disclosure Spoofing Vulnerability
• CVE-2025-33073: Microsoft Windows SMB Client Improper Access Control Vulnerability, published 2025-06-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-10-20. EPSS: 82.7% chance of exploitation in the next 30 days. Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
• CVE-2024-43572: Microsoft Windows Management Console Remote Code Execution Vulnerability, published 2024-10-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-10-08. EPSS: 66.7% chance of exploitation in the next 30 days. Microsoft Management Console Remote Code Execution Vulnerability
• CVE-2025-24054: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability, published 2025-03-11. Medium severity, CVSS 5.4. Actively exploited: in CISA KEV since 2025-04-17. EPSS: 62.3% chance of exploitation in the next 30 days. External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
• CVE-2024-43461: Microsoft Windows MSHTML Platform Spoofing Vulnerability, published 2024-09-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2024-09-16. EPSS: 54.5% chance of exploitation in the next 30 days. Windows MSHTML Platform Spoofing Vulnerability
• CVE-2024-43573: Microsoft Windows MSHTML Platform Spoofing Vulnerability, published 2024-10-08. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2024-10-08. EPSS: 46.1% chance of exploitation in the next 30 days. Windows MSHTML Platform Spoofing Vulnerability
• CVE-2013-3900: Microsoft WinVerifyTrust function Remote Code Execution, published 2013-12-11. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2022-01-10. EPSS: 44.6% chance of exploitation in the next 30 days. Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the…
• CVE-2024-38178: Microsoft Windows Scripting Engine Memory Corruption Vulnerability, published 2024-08-13. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2024-08-13. EPSS: 41.4% chance of exploitation in the next 30 days. Scripting Engine Memory Corruption Vulnerability
• CVE-2025-26633: Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability, published 2025-03-11. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2025-03-11. EPSS: 30.4% chance of exploitation in the next 30 days. Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.

Latest

• CVE-2026-97844, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97843, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97842, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97841, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97840, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97839, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97838, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97837, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97836, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97835, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.