Microsoft Windows 11 26h2 vulnerabilities

278 CVEs affecting Microsoft Windows 11 26h2, 1 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97844, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2026-96951: Microsoft Windows Command Injection Vulnerability, published 2026-10-13. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-10-13. EPSS: 1.5% chance of exploitation in the next 30 days. Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.
• CVE-2026-88091, published 2026-10-13. High severity, CVSS 7.8. EPSS: 2.9% chance of exploitation in the next 30 days. Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
• CVE-2026-96186, published 2026-10-13. High severity, CVSS 7.8. EPSS: 2.3% chance of exploitation in the next 30 days. Deserialization of untrusted data in Microsoft Windows Media Foundation allows an authorized attacker to elevate privileges locally.
• CVE-2026-87716, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.
• CVE-2026-85808, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
• CVE-2026-70031, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1.1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.
• CVE-2026-85322, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
• CVE-2026-96245, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
• CVE-2026-85334, published 2026-10-13. High severity, CVSS 7.5. EPSS: 1% chance of exploitation in the next 30 days. Out-of-bounds read in Windows Message Queuing Queue Manager allows an unauthorized attacker to disclose information over a network.
• CVE-2026-97814, published 2026-10-13. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

Latest

• CVE-2026-97844, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97843, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97842, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97841, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97840, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97839, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97838, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97837, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97836, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97835, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.