Msrc Windows 10 Version 1607 vulnerabilities

CVE-2026-20814 [HIGH] CWE-362 DirectX Graphics Kernel Elevation of Privilege Vulnerability DirectX Graphics Kernel Elevation of Privilege Vulnerability Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Graphics Kernel allows an authorized attacker to elevate privileges locally. FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerabilit

CVE-2026-20804 [HIGH] CWE-266 Windows Hello Tampering Vulnerability Windows Hello Tampering Vulnerability Description: Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally. Windows Hello: Windows Hello Microsoft: Microsoft Customer Action Required: Yes Impact: Tampering Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q

CVE-2026-20826 [HIGH] CWE-362 Tablet Windows User Interface (TWINUI) Subsystem Information Disclosure Vulnerability Tablet Windows User Interface (TWINUI) Subsystem Information Disclosure Vulnerability Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to elevate privileges locally. FAQ: What privileges could be gained by an attacker who successfully exploited

CVE-2026-20868 [HIGH] CWE-122 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability Description: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. FAQ: How could an attacker exploit this vulnerability? An attacker authenticated on the domain could exploit this vulnerability by tricking a

CVE-2026-20847 [MEDIUM] CWE-200 Microsoft Windows File Explorer Spoofing Vulnerability Microsoft Windows File Explorer Spoofing Vulnerability Description: Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network. Windows Shell: Windows Shell Microsoft: Microsoft Customer Action Required: Yes Impact: Spoofing Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Unlikely Re

CVE-2026-20828 [MEDIUM] CWE-125 Windows rndismp6.sys Information Disclosure Vulnerability Windows rndismp6.sys Information Disclosure Vulnerability Description: Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical attack. FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is Kernel memory

CVE-2026-20937 [MEDIUM] CWE-200 Windows File Explorer Information Disclosure Vulnerability Windows File Explorer Information Disclosure Vulnerability Description: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is an addre

CVE-2026-20925 [MEDIUM] CWE-73 NTLM Hash Disclosure Spoofing Vulnerability NTLM Hash Disclosure Spoofing Vulnerability Description: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Minimal interaction with a malicious file by a user such as selecting (single-click), inspecting (right-click), or performing an

CVE-2026-20839 [MEDIUM] CWE-284 Windows Client-Side Caching (CSC) Service Information Disclosure Vulnerability Windows Client-Side Caching (CSC) Service Information Disclosure Vulnerability Description: Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to disclose information locally. FAQ: What type of information could be disclosed by this vulnerability? An attacker who successfully exploited this vulnerability could potentially read portions o

CVE-2026-20872 [MEDIUM] CWE-73 NTLM Hash Disclosure Spoofing Vulnerability NTLM Hash Disclosure Spoofing Vulnerability Description: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Minimal interaction with a malicious file by a user such as selecting (single-click), inspecting (right-click), or performing an

CVE-2026-20812 [MEDIUM] CWE-20 LDAP Tampering Vulnerability LDAP Tampering Vulnerability Description: Improper input validation in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to perform tampering over a network. Windows LDAP - Lightweight Directory Access Protocol: Windows LDAP - Lightweight Directory Access Protocol Microsoft: Microsoft Customer Action Required: Yes Impact: Tampering Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software

CVE-2026-20805 [MEDIUM] CWE-200 Desktop Window Manager Information Disclosure Vulnerability Desktop Window Manager Information Disclosure Vulnerability Description: Exposure of sensitive information to an unauthorized actor in Desktop Windows Manager allows an authorized attacker to disclose information locally. FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is a se

CVE-2026-20927 [MEDIUM] CWE-362 Windows SMB Server Denial of Service Vulnerability Windows SMB Server Denial of Service Vulnerability Description: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to deny service over a network. FAQ: According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability? Successful exploitation of this vulnerability requires an

CVE-2026-20824 [MEDIUM] CWE-693 Windows Remote Assistance Security Feature Bypass Vulnerability Windows Remote Assistance Security Feature Bypass Vulnerability Description: Protection mechanism failure in Windows Remote Assistance allows an unauthorized attacker to bypass a security feature locally. FAQ: According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? Exploitation of the vulnerability requires that a user open a specially crafted f

CVE-2026-20932 [MEDIUM] CWE-200 Windows File Explorer Information Disclosure Vulnerability Windows File Explorer Information Disclosure Vulnerability Description: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is an addre

CVE-2026-20939 [MEDIUM] CWE-200 Windows File Explorer Information Disclosure Vulnerability Windows File Explorer Information Disclosure Vulnerability Description: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability is the loca

CVE-2026-20821 [MEDIUM] CWE-200 Remote Procedure Call Information Disclosure Vulnerability Remote Procedure Call Information Disclosure Vulnerability Description: Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally. FAQ: What type of information could be disclosed by this vulnerability? The type of information that could be disclosed if an attacker successfully exploited this vulnerability i

CVE-2026-20834 [MEDIUM] CWE-36 Windows Spoofing Vulnerability Windows Spoofing Vulnerability Description: Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack. Windows Shell: Windows Shell Microsoft: Microsoft Customer Action Required: Yes Impact: Spoofing Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5

CVE-2026-20823 [MEDIUM] CWE-200 Windows File Explorer Information Disclosure Vulnerability Windows File Explorer Information Disclosure Vulnerability Description: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally. FAQ: According to the CVSS metrics, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L),but lead to no loss of availability (A:N) and integrity (

CVE-2026-21265 [MEDIUM] CWE-1329 Secure Boot Certificate Expiration Security Feature Bypass Vulnerability Secure Boot Certificate Expiration Security Feature Bypass Vulnerability Description: Windows Secure Boot stores Microsoft certificates in the UEFI KEK and DB. These original certificates are approaching expiration, and devices containing affected certificate versions must update them to maintain Secure Boot functionality and avoid compromising security by losing security fixes related to W