Microsoft Windows 11 Version 26H2 vulnerabilities
1,007 known vulnerabilities affecting microsoft/windows_11_version_26h2.
Total CVEs
1,007
CISA KEV
1
actively exploited
Public exploits
0
Exploited in wild
1
Severity breakdown
CRITICAL44HIGH710MEDIUM253
Vulnerabilities
Page 43 of 51
CVE-2026-70057P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-70057 [MEDIUM] CWE-863 CVE-2026-70057: Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized att
Incorrect authorization in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to bypass a security feature locally.
nvd
CVE-2026-83671P4MEDIUMCVSS 6.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-83671 [MEDIUM] CWE-125 CVE-2026-83671: Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.
Out-of-bounds read in Windows Hyper-V allows an authorized attacker to disclose information locally.
nvd
CVE-2026-85816P4MEDIUMCVSS 5.7≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-85816 [MEDIUM] CWE-125 CVE-2026-85816: Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disclose information ove
Out-of-bounds read in Windows Wi-Fi Driver allows an authorized attacker to disclose information over an adjacent network.
nvd
CVE-2026-70055P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-70055 [MEDIUM] CWE-497 CVE-2026-70055: Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic
Exposure of sensitive system information to an unauthorized control sphere in Windows Cryptographic Services allows an authorized attacker to disclose information locally.
nvd
CVE-2026-83907P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-83907 [MEDIUM] CWE-497 CVE-2026-83907: Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows a
Exposure of sensitive system information to an unauthorized control sphere in Windows Hello allows an authorized attacker to disclose information locally.
nvd
CVE-2026-70260P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-70260 [MEDIUM] CWE-497 CVE-2026-70260: Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data H
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.
nvd
CVE-2026-70261P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-70261 [MEDIUM] CWE-497 CVE-2026-70261: Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data H
Exposure of sensitive system information to an unauthorized control sphere in Microsoft Trace Data Helper allows an authorized attacker to disclose information locally.
nvd
CVE-2026-69644P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-69644 [MEDIUM] CWE-497 CVE-2026-69644: Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows a
Exposure of sensitive system information to an unauthorized control sphere in Windows iSCSI allows an authorized attacker to disclose information locally.
nvd
CVE-2026-83705P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-83705 [MEDIUM] CWE-497 CVE-2026-83705: Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allow
Exposure of sensitive system information to an unauthorized control sphere in Windows HTTP.sys allows an authorized attacker to disclose information locally.
nvd
CVE-2026-83507P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-83507 [MEDIUM] CWE-59 CVE-2026-83507: Improper link resolution before file access ('link following') in Windows Update Orchestrator Servic
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.
nvd
CVE-2026-70084P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-70084 [MEDIUM] CWE-22 CVE-2026-70084: Improper access control in Windows Projected File System allows an authorized attacker to disclose i
Improper access control in Windows Projected File System allows an authorized attacker to disclose information locally.
nvd
CVE-2026-62687P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-62687 [MEDIUM] CWE-59 CVE-2026-62687: Improper link resolution before file access ('link following') in Windows Backup Engine allows an au
Improper link resolution before file access ('link following') in Windows Backup Engine allows an authorized attacker to disclose information locally.
nvd
CVE-2026-85910P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-85910 [MEDIUM] CWE-126 CVE-2026-85910: Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose informatio
Buffer over-read in Windows StateRepository API allows an authorized attacker to disclose information locally.
nvd
CVE-2026-70137P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-70137 [MEDIUM] CWE-306 CVE-2026-70137: Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to
Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to disclose information locally.
nvd
CVE-2026-70232P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-70232 [MEDIUM] CWE-497 CVE-2026-70232: Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
nvd
CVE-2026-70199P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-70199 [MEDIUM] CWE-497 CVE-2026-70199: Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
nvd
CVE-2026-108462P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-108462 [MEDIUM] CWE-497 CVE-2026-108462: Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows
Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an authorized attacker to disclose information locally.
nvd
CVE-2026-85812P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-85812 [MEDIUM] CWE-552 CVE-2026-85812: Files or directories accessible to external parties in Windows Bind Filter Driver allows an authoriz
Files or directories accessible to external parties in Windows Bind Filter Driver allows an authorized attacker to disclose information locally.
nvd
CVE-2026-83933P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-83933 [MEDIUM] CWE-59 CVE-2026-83933: Improper link resolution before file access ('link following') in Windows Update Orchestrator Servic
Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to disclose information locally.
nvd
CVE-2026-83565P4MEDIUMCVSS 5.5≥ 10.0.26300.0, < 10.0.26300.97112026-10-13
CVE-2026-83565 [MEDIUM] CWE-126 CVE-2026-83565: Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose i
Buffer over-read in Windows Encrypting File System (EFS) allows an authorized attacker to disclose information locally.
nvd