Windows 11 24h2 vulnerabilities

350 known vulnerabilities in Windows 11 24h2 from Microsoft. 341 are rated high or critical, and 49 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Windows 10 Version 21H2: Improper Neutralization of Argument Delimiters in a Command

  CVE-2026-97798Oct 13, 2026Microsoft

  Improper neutralization of argument delimiters in a command ('argument injection') in Windows Error Reporting allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 11 version 23H2: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-97787Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Container Isolation FS Filter Driver (unionfs.sys) allows an authorized attacker to elevate privileges locally.

• 8.8 High severity

  Microsoft Windows Command Injection Exploited

  CVE-2026-96951Oct 13, 2026MicrosoftEPSS 9.81%

  Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-96932Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Embedded Mode Service allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Improper Link Resolution Before File Access

  CVE-2026-96911Oct 13, 2026Microsoft

  Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 11 Version 24H2: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-96215Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Autopilot allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Improper Link Resolution Before File Access

  CVE-2026-88191Oct 13, 2026Microsoft

  Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-88160Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-88146Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Background Intelligent Transfer Service (BITS) allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-88096Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DCOM Server allows an authorized attacker to elevate privileges locally.

• 7.4 High severity

  Windows 10 Version 1607: Improper Verification of Source of a Communication Channel

  CVE-2026-87705Oct 13, 2026Microsoft

  Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.

• 7.0 High severity

  Windows 10 Version 1607: Heap-based Buffer Overflow

  CVE-2026-85943Oct 13, 2026Microsoft

  Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-85941Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-85912Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard User Service allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-85904Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 11 Version 24H2: Missing Authentication for Critical Functionality

  CVE-2026-85884Oct 13, 2026Microsoft

  Missing authentication for critical function in Windows Health and Optimized Experiences Service allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Improper Link Resolution Before File Access

  CVE-2026-85849Oct 13, 2026Microsoft

  Improper link resolution before file access ('link following') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 11 version 23H2: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-85357Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Phone Service allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Inclusion of Functionality from Untrusted Control Sphere

  CVE-2026-85355Oct 13, 2026Microsoft

  Inclusion of functionality from untrusted control sphere in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-85333Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Performance Monitor allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-85329Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Account allows an authorized attacker to elevate privileges locally.

• 7.5 High severity

  Windows 10 Version 1607: Use of Uninitialized Resource

  CVE-2026-85322Oct 13, 2026MicrosoftEPSS 1.03%

  Use of uninitialized resource in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-83879Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-83868Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Bluetooth Driver allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-83841Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 21H2: Improper Link Resolution Before File Access

  CVE-2026-83793Oct 13, 2026Microsoft

  Improper link resolution before file access ('link following') in Windows Update Orchestrator Service allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Heap-based Buffer Overflow

  CVE-2026-83775Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Installer allows an authorized attacker to elevate privileges locally.

• 8.8 High severity

  Windows 10 Version 1607: Improper Control of Generation of Code

  CVE-2026-83759Oct 13, 2026Microsoft

  Improper control of generation of code ('code injection') in Windows Encrypting File System (EFS) allows an authorized attacker to execute code over a network.

• 7.8 High severity

  Windows 10 Version 1607: Improper Link Resolution Before File Access

  CVE-2026-83704Oct 13, 2026Microsoft

  Improper link resolution before file access ('link following') in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Improper Link Resolution Before File Access

  CVE-2026-83659Oct 13, 2026Microsoft

  Improper link resolution before file access ('link following') in Windows User Profile Service allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-81971Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-71347Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Security Center allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Access of Resource Using Incompatible Type

  CVE-2026-70245Oct 13, 2026Microsoft

  Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Access of Resource Using Incompatible Type

  CVE-2026-70225Oct 13, 2026Microsoft

  Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Improper Restriction of Communication Channel to Intended Endpoints

  CVE-2026-70212Oct 13, 2026Microsoft

  Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Access of Resource Using Incompatible Type

  CVE-2026-70205Oct 13, 2026Microsoft

  Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-70169Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

• 8.8 High severity

  Windows 10 Version 1607: Heap-based Buffer Overflow

  CVE-2026-70149Oct 13, 2026Microsoft

  Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose information locally.

• 7.0 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-69931Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Storage allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-69736Oct 13, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Manager allows an authorized attacker to elevate privileges locally.