Microsoft Windows 11 26h1 vulnerabilities

1,806 CVEs affecting Microsoft Windows 11 26h1, 5 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97844, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-32202: Microsoft Windows Protection Mechanism Failure Vulnerability, published 2026-04-14. Medium severity, CVSS 4.3. Actively exploited: in CISA KEV since 2026-04-28. EPSS: 4.9% chance of exploitation in the next 30 days. Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-33824: Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Vulnerability, published 2026-04-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2026-08-18. EPSS: 1.6% chance of exploitation in the next 30 days. Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.
• CVE-2026-96951: Microsoft Windows Command Injection Vulnerability, published 2026-10-13. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-10-13. EPSS: 1.5% chance of exploitation in the next 30 days. Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-81963: Microsoft Windows Link Following Vulnerability, published 2026-09-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2026-09-08. EPSS: 0.4% chance of exploitation in the next 30 days. Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.
• CVE-2026-68820: Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability, published 2026-08-11. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2026-08-11. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
• CVE-2026-24294, published 2026-03-10. High severity, CVSS 7.8. EPSS: 4.9% chance of exploitation in the next 30 days. Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-24289, published 2026-03-10. High severity, CVSS 7.8. EPSS: 4.7% chance of exploitation in the next 30 days. Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
• CVE-2026-50509, published 2026-07-14. High severity, CVSS 7.8. EPSS: 3.5% chance of exploitation in the next 30 days. Deserialization of untrusted data in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.
• CVE-2026-33829, published 2026-04-14. Medium severity, CVSS 4.3. EPSS: 3.5% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Windows Snipping Tool allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-24291, published 2026-03-10. High severity, CVSS 7.8. EPSS: 3.3% chance of exploitation in the next 30 days. Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.

Latest

• CVE-2026-97844, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97843, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97842, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97841, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97840, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97839, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97838, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97837, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97836, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97835, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.