Microsoft Windows 11 25h2 vulnerabilities

2,094 CVEs affecting Microsoft Windows 11 25h2, 17 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97844, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability, published 2026-02-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-02-10. EPSS: 24.5% chance of exploitation in the next 30 days. Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-21513: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability, published 2026-02-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-02-10. EPSS: 15.9% chance of exploitation in the next 30 days. Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-20805: Microsoft Windows Information Disclosure Vulnerability, published 2026-01-13. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2026-01-13. EPSS: 7.5% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally.
• CVE-2025-24990: Microsoft Windows Untrusted Pointer Dereference Vulnerability, published 2025-10-14. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2025-10-14. EPSS: 6.4% chance of exploitation in the next 30 days. Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of…
• CVE-2025-47827: IGEL OS Use of a Key Past its Expiration Date Vulnerability, published 2025-06-05. Medium severity, CVSS 4.6. Actively exploited: in CISA KEV since 2025-10-14. EPSS: 4.9% chance of exploitation in the next 30 days. In IGEL OS before 11, Secure Boot can be bypassed because the igel-flash-driver module improperly verifies a cryptographic signature. Ultimately, a crafted root filesystem can be mounted from an…
• CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability, published 2026-04-14. Medium severity, CVSS 4.3. Actively exploited: in CISA KEV since 2026-04-28. EPSS: 4.9% chance of exploitation in the next 30 days. Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-21525: Microsoft Windows NULL Pointer Dereference Vulnerability, published 2026-02-10. Medium severity, CVSS 6.2. Actively exploited: in CISA KEV since 2026-02-10. EPSS: 4.8% chance of exploitation in the next 30 days. Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.
• CVE-2025-60710: Microsoft Windows Link Following Vulnerability, published 2025-11-11. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-04-13. EPSS: 4.6% chance of exploitation in the next 30 days. Improper link resolution before file access ('link following') in Host Process for Windows Tasks allows an authorized attacker to elevate privileges locally.
• CVE-2025-62215: Microsoft Windows Race Condition Vulnerability, published 2025-11-11. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2025-11-12. EPSS: 4.5% chance of exploitation in the next 30 days. Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
• CVE-2026-21533: Microsoft Windows Improper Privilege Management Vulnerability, published 2026-02-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-02-10. EPSS: 4.1% chance of exploitation in the next 30 days. Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

Latest

• CVE-2026-97844, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97843, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97842, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97841, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97840, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97839, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97838, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97837, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97836, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97835, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.