Windows 11 26h1 vulnerabilities

210 known vulnerabilities in Windows 11 26h1 from Microsoft. 209 are rated high or critical, and 5 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Windows 10 Version 21H2: External Control of File Name or Path

  CVE-2026-41088May 12, 2026Microsoft

  Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Stack-based Buffer Overflow

  CVE-2026-40399May 12, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

• 7.5 High severity

  Windows 10 Version 1607: Missing Release of Memory after Effective Lifetime

  CVE-2026-35424May 12, 2026MicrosoftEPSS 1.19%

  Missing release of memory after effective lifetime in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

• 7.0 High severity

  Windows 10 Version 1607: Use After Free

  CVE-2026-35416May 12, 2026MicrosoftEPSS 1.65%

  Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-34351May 12, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-34345May 12, 2026Microsoft

  Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Access of Resource Using Incompatible Type

  CVE-2026-34344May 12, 2026Microsoft

  Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-34342May 12, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-34334May 12, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-34331May 12, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Integer Overflow or Wraparound

  CVE-2026-34330May 12, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-33839May 12, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

• 7.5 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32161May 12, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Native WiFi Miniport Driver allows an unauthorized attacker to execute code over an adjacent network.

• 8.1 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-33827Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over a network.

• 9.8 Critical severity

  Microsoft Internet Key Exchange (IKE) Service Extensions Double Free Exploited

  CVE-2026-33824Apr 14, 2026MicrosoftEPSS 77.4%

  Double free in Windows IKE Extension allows an unauthorized attacker to execute code over a network.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-33104Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

• 8.8 High severity

  Windows 10 Version 1607: Protection Mechanism Failure

  CVE-2026-32225Apr 14, 2026MicrosoftEPSS 1.24%

  Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

• 4.3 Medium severity

  Microsoft Windows Protection Mechanism Failure Exploited

  CVE-2026-32202Apr 14, 2026MicrosoftEPSS 71.3%

  Protection mechanism failure in Windows Shell allows an unauthorized attacker to perform spoofing over a network.

• 7.8 High severity

  Windows 10 Version 1607: Improper Neutralization of Special Elements used in a Command

  CVE-2026-32183Apr 14, 2026Microsoft

  Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code locally.

• 7.8 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32164Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32163Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32160Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32159Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32158Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32150Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Heap-based Buffer Overflow

  CVE-2026-32093Apr 14, 2026MicrosoftEPSS 1.16%

  Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32091Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Brokering File System allows an unauthorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32090Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Speech Brokered Api allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32086Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32083Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32082Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

• 7.5 High severity

  Windows 10 Version 1607: NULL Pointer Dereference

  CVE-2026-32071Apr 14, 2026MicrosoftEPSS 1.1%

  Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-32068Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-27927Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-27926Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-27921Apr 14, 2026MicrosoftEPSS 1.24%

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1809: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-27918Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-27911Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-26174Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Server Update Service allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-26173Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.