Windows 11 26h1 vulnerabilities

210 known vulnerabilities in Windows 11 26h1 from Microsoft. 209 are rated high or critical, and 5 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 7.8 High severity

  Windows 10 Version 21H2: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-26172Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-26168Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-26167Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 11 version 23H2: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-25184Apr 14, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Improper Validation of Specified Type of Input

  CVE-2026-25179Mar 10, 2026Microsoft

  Improper validation of specified type of input in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

• 8.8 High severity

  Windows 10 Version 1607: Improper Restriction of Names for Files and Other Resources

  CVE-2026-25177Mar 10, 2026MicrosoftEPSS 1.35%

  Improper restriction of names for files and other resources in Active Directory Domain Services allows an authorized attacker to elevate privileges over a network.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-24296Mar 10, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-24295Mar 10, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Device Association Service allows an authorized attacker to elevate privileges locally.

• 7.8 High severity

  Windows 10 Version 1607: Incorrect Permission Assignment for Critical Resource

  CVE-2026-24291Mar 10, 2026MicrosoftEPSS 4.61%

  Incorrect permission assignment for critical resource in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to elevate privileges locally.

• 7.0 High severity

  Windows 10 Version 1607: Concurrent Execution using Shared Resource with Improper Synchronization

  CVE-2026-23671Mar 10, 2026Microsoft

  Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Bluetooth RFCOM Protocol Driver allows an authorized attacker to elevate privileges locally.