Microsoft Windows 11 Version 26H1 vulnerabilities

CVE-2026-49174 [MEDIUM] CWE-306 CVE-2026-49174: Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker Missing authentication for critical function in Microsoft Windows DNS allows an authorized attacker to perform tampering locally.

CVE-2026-69317 [MEDIUM] CWE-125 CVE-2026-69317: Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information ov Out-of-bounds read in Remote Desktop Client allows an authorized attacker to disclose information over a network.

CVE-2026-65777 [MEDIUM] CWE-326 CVE-2026-65777: Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a Inadequate encryption strength in Windows Active Directory allows an authorized attacker to bypass a security feature over a network.

CVE-2026-26152 [HIGH] CWE-922 CVE-2026-26152: Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized att Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.

CVE-2026-83573 [MEDIUM] CWE-190 CVE-2026-83573: Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthorized attacker to elev Integer overflow or wraparound in Windows Kernel Mode Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-49168 [MEDIUM] CWE-190 CVE-2026-49168: Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to e Integer overflow or wraparound in Windows Storage Spaces Direct allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-69373 [MEDIUM] CWE-125 CVE-2026-69373: Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate pr Integer overflow or wraparound in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

CVE-2026-72935 [MEDIUM] CWE-125 CVE-2026-72935: Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally. Out-of-bounds read in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVE-2026-65795 [MEDIUM] CWE-197 CVE-2026-65795: Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally. Relative path traversal in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-96300 [MEDIUM] CWE-770 CVE-2026-96300: Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to Uncontrolled resource consumption in RPC Endpoint Mapper Service allows an unauthorized attacker to deny service over a network.

CVE-2026-69723 [MEDIUM] CWE-497 CVE-2026-69723: Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information over a network.

CVE-2026-69507 [MEDIUM] CWE-538 CVE-2026-69507: Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Insertion of sensitive information into externally-accessible file or directory in Microsoft Windows Search Component allows an authorized attacker to disclose information over a network.

CVE-2026-69349 [MEDIUM] CWE-908 CVE-2026-69349: Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to Use of uninitialized resource in Windows Management Instrumentation allows an authorized attacker to disclose information over a network.

CVE-2026-102198 [MEDIUM] CWE-125 CVE-2026-102198: Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose info Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network.

CVE-2026-83776 [MEDIUM] CWE-125 CVE-2026-83776: Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileg Out-of-bounds read in Microsoft Bluetooth Driver allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-57097 [MEDIUM] CWE-426 CVE-2026-57097: Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature Untrusted search path in Microsoft XML allows an unauthorized attacker to bypass a security feature with a physical attack.

CVE-2026-77892 [MEDIUM] CWE-693 CVE-2026-77892: No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges No cwe for this issue in Windows Boot Manager allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-50298 [MEDIUM] CWE-190 CVE-2026-50298: Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate p Integer overflow or wraparound in Windows Spaceport.sys allows an unauthorized attacker to elevate privileges with a physical attack.

CVE-2026-62881 [MEDIUM] CWE-122 CVE-2026-62881: Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.

CVE-2026-62769 [MEDIUM] CWE-122 CVE-2026-62769: Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally. Numeric truncation error in Windows DNS allows an authorized attacker to elevate privileges locally.