Microsoft Windows 11 Version 26H1 vulnerabilities
2,571 known vulnerabilities affecting microsoft/windows_11_version_26h1.
Total CVEs
2,571
CISA KEV
10
actively exploited
Public exploits
6
Exploited in wild
13
Severity breakdown
CRITICAL93HIGH1902MEDIUM571LOW5
Vulnerabilities
Page 22 of 129
CVE-2026-70095P3HIGHCVSS 7.5≥ 10.0.28000.0, < 10.0.28000.32312026-10-13
CVE-2026-70095 [HIGH] CWE-122 CVE-2026-70095: Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a n
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-96071P3HIGHCVSS 7.5≥ 10.0.28000.0, < 10.0.28000.32312026-10-13
CVE-2026-96071 [HIGH] CWE-122 CVE-2026-96071: Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a n
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-69602P3HIGHCVSS 7.5≥ 10.0.28000.0, < 10.0.28000.29542026-09-08
CVE-2026-69602 [HIGH] CWE-416 CVE-2026-69602: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges o
Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-69706P3HIGHCVSS 7.5≥ 10.0.28000.0, < 10.0.28000.29542026-09-08
CVE-2026-69706 [HIGH] CWE-416 CVE-2026-69706: Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network.
Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-69597P3HIGHCVSS 7.5≥ 10.0.28000.0, < 10.0.28000.29542026-09-08
CVE-2026-69597 [HIGH] CWE-416 CVE-2026-69597: Use after free in Windows HTTP.sys allows an authorized attacker to elevate privileges over a networ
Use after free in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-78446P3HIGHCVSS 7.5≥ 10.0.28000.0, < 10.0.28000.29542026-09-08
CVE-2026-78446 [HIGH] CWE-416 CVE-2026-78446: Use after free in Windows Distributed File System (DFS) allows an authorized attacker to execute cod
Use after free in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
nvd
CVE-2026-85798P3HIGHCVSS 7.2≥ 10.0.28000.0, < 10.0.28000.32312026-10-13
CVE-2026-85798 [HIGH] CWE-122 CVE-2026-85798: Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
nvd
CVE-2026-24291P3HIGHCVSS 7.8≥ 10.0.28000.0, < 10.0.28000.17192026-03-10
CVE-2026-24291 [HIGH] CWE-732 CVE-2026-24291: Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBro
Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-88091P3HIGHCVSS 7.8≥ 10.0.28000.0, < 10.0.28000.32312026-10-13
CVE-2026-88091 [HIGH] CWE-502 CVE-2026-88091: Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacke
Deserialization of untrusted data in Windows Management Instrumentation allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-49795P3HIGHCVSS 8.8≥ 10.0.28000.0, < 10.0.28000.25252026-07-14
CVE-2026-49795 [HIGH] CWE-416 CVE-2026-49795: Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50382P3HIGHCVSS 8.8≥ 10.0.28000.0, < 10.0.28000.25252026-07-14
CVE-2026-50382 [HIGH] CWE-822 CVE-2026-50382: Untrusted pointer dereference in Windows DirectX allows an authorized attacker to execute code local
Untrusted pointer dereference in Windows DirectX allows an authorized attacker to execute code locally.
nvd
CVE-2026-96914P3HIGHCVSS 8.8≥ 10.0.28000.0, < 10.0.28000.32312026-10-13
CVE-2026-96914 [HIGH] CWE-122 CVE-2026-96914: Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an auth
Integer overflow or wraparound in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-69945P3HIGHCVSS 8.8≥ 10.0.28000.0, < 10.0.28000.32312026-10-13
CVE-2026-69945 [HIGH] CWE-862 CVE-2026-69945: Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate
Missing authorization in Windows AppX Deployment Extensions allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-70185P3HIGHCVSS 8.8≥ 10.0.28000.0, < 10.0.28000.32312026-10-13
CVE-2026-70185 [HIGH] CWE-639 CVE-2026-70185: Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a securit
Protection mechanism failure in Windows PowerShell allows an authorized attacker to bypass a security feature locally.
nvd
CVE-2026-50385P3HIGHCVSS 8.8≥ 10.0.28000.0, < 10.0.28000.25252026-07-14
CVE-2026-50385 [HIGH] CWE-362 CVE-2026-50385: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Runtime allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-21231P3HIGHCVSS 7.8≥ 10.0.28000.0, < 10.0.28000.15752026-02-10
CVE-2026-21231 [HIGH] CWE-362 CVE-2026-21231: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-33835P3HIGHCVSS 7.8≥ 10.0.28000.0, < 10.0.28000.21132026-05-12
CVE-2026-33835 [HIGH] CWE-416 CVE-2026-33835: Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate pr
Use after free in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-42905P3HIGHCVSS 7.8≥ 10.0.28000.0, < 10.0.28000.22692026-06-09
CVE-2026-42905 [HIGH] CWE-416 CVE-2026-42905: Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges local
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-56189P3HIGHCVSS 8.4≥ 10.0.28000.0, < 10.0.28000.25252026-07-14
CVE-2026-56189 [HIGH] CWE-122 CVE-2026-56189: Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.
nvd
CVE-2024-49123P3HIGHCVSS 8.1≥ 10.0.28000.0, < 10.0.28000.22692024-12-12
CVE-2024-49123 [HIGH] CWE-591 CVE-2024-49123: Windows Remote Desktop Services Remote Code Execution Vulnerability
Windows Remote Desktop Services Remote Code Execution Vulnerability
nvd