# Windows vulnerabilities

> Windows is made by Microsoft. We track 8,294 published vulnerabilities listed under that exact name, across 11 versions. 78 of them are on the list of flaws known to be exploited, the newest added on 13 April 2026. Microsoft lists newer releases under their own names, such as Windows Server 2016, so check those pages too.

Canonical page: https://www.precursorintelligence.com/product/microsoft/windows

## At a glance

- **Made by:** [Microsoft](https://www.precursorintelligence.com/vendors/microsoft)
- **Published vulnerabilities:** 8,294
- **Known to be exploited:** 78 (listed under the name Windows)
- **Versions tracked:** 11
- **Most recently added to the known-exploited list:** [CVE-2020-9715](https://www.precursorintelligence.com/what-is/cve-2020-9715), 13 April 2026. We keep watching the list.

## Is Windows listed under other names?

Microsoft also lists Windows under more specific names, such as Windows Server 2016 and Windows Server 2019. Flaws listed only under those names are counted on their own pages, not here.

- [Windows Server 2016](https://www.precursorintelligence.com/product/microsoft/windows_server_2016): 4,711 published vulnerabilities
- [Windows Server 2019](https://www.precursorintelligence.com/product/microsoft/windows_server_2019): 4,111 published vulnerabilities
- [Windows 10](https://www.precursorintelligence.com/product/microsoft/windows_10): 4,066 published vulnerabilities
- [Windows Server 2008](https://www.precursorintelligence.com/product/microsoft/windows_server_2008): 3,906 published vulnerabilities
- [Windows Server 2012](https://www.precursorintelligence.com/product/microsoft/windows_server_2012): 3,842 published vulnerabilities
- [Windows 7](https://www.precursorintelligence.com/product/microsoft/windows_7): 3,087 published vulnerabilities
- [Windows 8.1](https://www.precursorintelligence.com/product/microsoft/windows_8.1): 2,876 published vulnerabilities
- [Windows Rt 8.1](https://www.precursorintelligence.com/product/microsoft/windows_rt_8.1): 2,336 published vulnerabilities
- [Windows Server 2022](https://www.precursorintelligence.com/product/microsoft/windows_server_2022): 2,137 published vulnerabilities
- [Windows 11 22H2](https://www.precursorintelligence.com/product/microsoft/windows_11_22h2): 1,473 published vulnerabilities
- [Windows 10 1809](https://www.precursorintelligence.com/product/microsoft/windows_10_1809): 1,465 published vulnerabilities
- [Windows 10 21H2](https://www.precursorintelligence.com/product/microsoft/windows_10_21h2): 1,430 published vulnerabilities

## Which Windows vulnerabilities are being exploited?

50 flaws are on the government list of vulnerabilities known to be exploited, newest first:

- [CVE-2020-9715](https://www.precursorintelligence.com/what-is/cve-2020-9715): Adobe Acrobat Use-After-Free Vulnerability. High, CVSS 7.8, chance of use in 30 days 49%, known exploited since 13 April 2026.
- [CVE-2025-41244](https://www.precursorintelligence.com/what-is/cve-2025-41244): Broadcom VMware Aria Operations and VMware Tools Privilege Defined with Unsafe Actions Vulnerability. High, CVSS 7.8, chance of use in 30 days 8.4%, known exploited since 30 October 2025.
- [CVE-2025-10585](https://www.precursorintelligence.com/what-is/cve-2025-10585): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 5.4%, known exploited since 23 September 2025.
- [CVE-2025-8088](https://www.precursorintelligence.com/what-is/cve-2025-8088): RARLAB WinRAR Path Traversal Vulnerability. High, CVSS 8.8, chance of use in 30 days 95%, known exploited since 12 August 2025.
- [CVE-2025-6554](https://www.precursorintelligence.com/what-is/cve-2025-6554): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.1, chance of use in 30 days 14%, known exploited since 2 July 2025.
- [CVE-2025-34028](https://www.precursorintelligence.com/what-is/cve-2025-34028): Commvault Command Center Path Traversal Vulnerability. Critical, CVSS 10.0, chance of use in 30 days 98%, known exploited since 2 May 2025.
- [CVE-2025-3928](https://www.precursorintelligence.com/what-is/cve-2025-3928): Commvault Web Server Unspecified Vulnerability. High, CVSS 8.8, chance of use in 30 days 2.5%, known exploited since 28 April 2025.
- [CVE-2025-2783](https://www.precursorintelligence.com/what-is/cve-2025-2783): Google Chromium Mojo Sandbox Escape Vulnerability. High, CVSS 8.3, chance of use in 30 days 9.2%, known exploited since 27 March 2025.
- [CVE-2022-23748](https://www.precursorintelligence.com/what-is/cve-2022-23748): Dante Discovery Process Control Vulnerability. High, CVSS 7.8, chance of use in 30 days 8.3%, known exploited since 6 February 2025.
- [CVE-2013-0648](https://www.precursorintelligence.com/what-is/cve-2013-0648): Adobe Flash Player Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 11%, known exploited since 17 September 2024.
- [CVE-2014-0502](https://www.precursorintelligence.com/what-is/cve-2014-0502): Adobe Flash Player Double Free Vulnerablity. High, CVSS 8.8, chance of use in 30 days 25%, known exploited since 17 September 2024.
- [CVE-2014-0497](https://www.precursorintelligence.com/what-is/cve-2014-0497): Adobe Flash Player Integer Underflow Vulnerablity. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 17 September 2024.
- [CVE-2013-0643](https://www.precursorintelligence.com/what-is/cve-2013-0643): Adobe Flash Player Incorrect Default Permissions Vulnerability. High, CVSS 8.8, chance of use in 30 days 11%, known exploited since 17 September 2024.
- [CVE-2024-7262](https://www.precursorintelligence.com/what-is/cve-2024-7262): Kingsoft WPS Office Path Traversal Vulnerability. Critical, CVSS 9.3, chance of use in 30 days 2.9%, known exploited since 3 September 2024.
- [CVE-2024-4577](https://www.precursorintelligence.com/what-is/cve-2024-4577): PHP-CGI OS Command Injection Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 12 June 2024.
- [CVE-2023-21608](https://www.precursorintelligence.com/what-is/cve-2023-21608): Adobe Acrobat and Reader Use-After-Free Vulnerability. High, CVSS 7.8, chance of use in 30 days 60%, known exploited since 10 October 2023.
- [CVE-2023-41179](https://www.precursorintelligence.com/what-is/cve-2023-41179): Trend Micro Apex One and Worry-Free Business Security Remote Code Execution Vulnerability. High, CVSS 7.2, chance of use in 30 days 4.3%, known exploited since 21 September 2023.
- [CVE-2023-26369](https://www.precursorintelligence.com/what-is/cve-2023-26369): Adobe Acrobat and Reader Out-of-Bounds Write Vulnerability. High, CVSS 7.8, chance of use in 30 days 6.7%, known exploited since 14 September 2023.
- [CVE-2016-9079](https://www.precursorintelligence.com/what-is/cve-2016-9079): Mozilla Firefox, Firefox ESR, and Thunderbird Use-After-Free Vulnerability. High, CVSS 7.5, chance of use in 30 days 88%, known exploited since 22 June 2023.
- [CVE-2023-3079](https://www.precursorintelligence.com/what-is/cve-2023-3079): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 38%, known exploited since 7 June 2023.
- [CVE-2020-5741](https://www.precursorintelligence.com/what-is/cve-2020-5741): Plex Media Server Remote Code Execution Vulnerability. High, CVSS 7.2, chance of use in 30 days 73%, known exploited since 10 March 2023.
- [CVE-2022-47986](https://www.precursorintelligence.com/what-is/cve-2022-47986): IBM Aspera Faspex Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 21 February 2023.
- [CVE-2015-2291](https://www.precursorintelligence.com/what-is/cve-2015-2291): Intel Ethernet Diagnostics Driver for Windows Denial-of-Service Vulnerability. High, CVSS 7.8, chance of use in 30 days 9.0%, known exploited since 10 February 2023.
- [CVE-2022-40139](https://www.precursorintelligence.com/what-is/cve-2022-40139): Trend Micro Apex One and Apex One as a Service Improper Validation Vulnerability. High, CVSS 7.2, chance of use in 30 days 3.3%, known exploited since 15 September 2022.
- [CVE-2022-2856](https://www.precursorintelligence.com/what-is/cve-2022-2856): Google Chromium Intents Insufficient Input Validation Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 4.6%, known exploited since 18 August 2022.
- [CVE-2010-1297](https://www.precursorintelligence.com/what-is/cve-2010-1297): Adobe Flash Player Memory Corruption Vulnerability. High, CVSS 7.8, chance of use in 30 days 83%, known exploited since 8 June 2022.
- [CVE-2011-2462](https://www.precursorintelligence.com/what-is/cve-2011-2462): Adobe Reader and Acrobat Universal 3D Memory Corruption Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 89%, known exploited since 8 June 2022.
- [CVE-2009-3953](https://www.precursorintelligence.com/what-is/cve-2009-3953): Adobe Acrobat and Reader Universal 3D Remote Code Execution Vulnerability. High, CVSS 8.8, chance of use in 30 days 83%, known exploited since 8 June 2022.
- [CVE-2012-0754](https://www.precursorintelligence.com/what-is/cve-2012-0754): Adobe Flash Player Memory Corruption Vulnerability. High, CVSS 8.1, chance of use in 30 days 91%, known exploited since 8 June 2022.
- [CVE-2012-0767](https://www.precursorintelligence.com/what-is/cve-2012-0767): Adobe Flash Player Cross-Site Scripting (XSS) Vulnerability. Medium, CVSS 6.1, chance of use in 30 days 6.2%, known exploited since 8 June 2022.
- [CVE-2016-5198](https://www.precursorintelligence.com/what-is/cve-2016-5198): Google Chromium V8 Out-of-Bounds Memory Vulnerability. High, CVSS 8.8, chance of use in 30 days 34%, known exploited since 8 June 2022.
- [CVE-2017-5030](https://www.precursorintelligence.com/what-is/cve-2017-5030): Google Chromium V8 Memory Corruption Vulnerability. High, CVSS 8.8, chance of use in 30 days 41%, known exploited since 8 June 2022.
- [CVE-2017-5070](https://www.precursorintelligence.com/what-is/cve-2017-5070): Google Chromium V8 Type Confusion Vulnerability. High, CVSS 8.8, chance of use in 30 days 32%, known exploited since 8 June 2022.
- [CVE-2009-4324](https://www.precursorintelligence.com/what-is/cve-2009-4324): Adobe Acrobat and Reader Use-After-Free Vulnerability. High, CVSS 7.8, chance of use in 30 days 82%, known exploited since 8 June 2022.
- [CVE-2018-4990](https://www.precursorintelligence.com/what-is/cve-2018-4990): Adobe Acrobat and Reader Double Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 36%, known exploited since 8 June 2022.
- [CVE-2011-0609](https://www.precursorintelligence.com/what-is/cve-2011-0609): Adobe Flash Player Unspecified Vulnerability. High, CVSS 7.8, chance of use in 30 days 64%, known exploited since 8 June 2022.
- [CVE-2010-2883](https://www.precursorintelligence.com/what-is/cve-2010-2883): Adobe Acrobat and Reader Stack-Based Buffer Overflow Vulnerability. High, CVSS 7.3, chance of use in 30 days 81%, known exploited since 8 June 2022.
- [CVE-2015-0310](https://www.precursorintelligence.com/what-is/cve-2015-0310): Adobe Flash Player ASLR Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 15%, known exploited since 25 May 2022.
- [CVE-2016-1010](https://www.precursorintelligence.com/what-is/cve-2016-1010): Adobe Flash Player and AIR Integer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 19%, known exploited since 25 May 2022.
- [CVE-2015-8651](https://www.precursorintelligence.com/what-is/cve-2015-8651): Adobe Flash Player Integer Overflow Vulnerability. High, CVSS 8.8, chance of use in 30 days 68%, known exploited since 25 May 2022.
- [CVE-2014-0546](https://www.precursorintelligence.com/what-is/cve-2014-0546): Adobe Reader and Acrobat Sandbox Bypass Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 22%, known exploited since 25 May 2022.
- [CVE-2016-0984](https://www.precursorintelligence.com/what-is/cve-2016-0984): Adobe Flash Player and AIR Use-After-Free Vulnerability. High, CVSS 8.8, chance of use in 30 days 55%, known exploited since 25 May 2022.
- [CVE-2014-8439](https://www.precursorintelligence.com/what-is/cve-2014-8439): Adobe Flash Player Dereferenced Pointer Vulnerability. High, CVSS 8.8, chance of use in 30 days 20%, known exploited since 25 May 2022.
- [CVE-2018-5002](https://www.precursorintelligence.com/what-is/cve-2018-5002): Adobe Flash Player Stack-based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 25%, known exploited since 23 May 2022.
- [CVE-2014-9163](https://www.precursorintelligence.com/what-is/cve-2014-9163): Adobe Flash Player Stack-Based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 21%, known exploited since 13 April 2022.
- [CVE-2015-0313](https://www.precursorintelligence.com/what-is/cve-2015-0313): Adobe Flash Player Use-After-Free Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 95%, known exploited since 13 April 2022.
- [CVE-2015-0311](https://www.precursorintelligence.com/what-is/cve-2015-0311): Adobe Flash Player Remote Code Execution Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 86%, known exploited since 13 April 2022.
- [CVE-2015-3113](https://www.precursorintelligence.com/what-is/cve-2015-3113): Adobe Flash Player Heap-Based Buffer Overflow Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 13 April 2022.
- [CVE-2015-5122](https://www.precursorintelligence.com/what-is/cve-2015-5122): Adobe Flash Player Use-After-Free Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 94%, known exploited since 13 April 2022.
- [CVE-2015-5123](https://www.precursorintelligence.com/what-is/cve-2015-5123): Adobe Flash Player Use-After-Free Vulnerability. Critical, CVSS 9.8, chance of use in 30 days 19%, known exploited since 13 April 2022.

## Which Windows flaws are most likely to be used?

Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days):

- [CVE-2014-0497](https://www.precursorintelligence.com/what-is/cve-2014-0497): >99%, Critical (CVSS 9.8), known exploited
- [CVE-2011-0611](https://www.precursorintelligence.com/what-is/cve-2011-0611): >99%, High (CVSS 8.8), known exploited
- [CVE-2015-0313](https://www.precursorintelligence.com/what-is/cve-2015-0313): 95%, Critical (CVSS 9.8), known exploited
- [CVE-2014-0515](https://www.precursorintelligence.com/what-is/cve-2014-0515): 94%, Critical (CVSS 10.0)
- [CVE-2010-0425](https://www.precursorintelligence.com/what-is/cve-2010-0425): 94%, Critical (CVSS 10.0)
- [CVE-2013-0625](https://www.precursorintelligence.com/what-is/cve-2013-0625): 94%, Critical (CVSS 9.8), known exploited
- [CVE-2014-0569](https://www.precursorintelligence.com/what-is/cve-2014-0569): 91%, Critical (CVSS 9.3)
- [CVE-2012-0754](https://www.precursorintelligence.com/what-is/cve-2012-0754): 91%, High (CVSS 8.1), known exploited
- [CVE-2012-0779](https://www.precursorintelligence.com/what-is/cve-2012-0779): 87%, Critical (CVSS 9.3)

## Questions

### How many vulnerabilities does Windows have?

We track 8,294 published vulnerabilities listed under the name Windows, across 11 versions. The most recent Windows flaw added to the known-exploited list is CVE-2020-9715, on 13 April 2026.

### Which Windows vulnerabilities are being exploited?

78 are on the list of flaws known to be exploited. The most recently added are CVE-2020-9715, CVE-2025-41244 and CVE-2025-10585.

### Why are newer Windows flaws missing from this page?

Microsoft also lists Windows under more specific names, such as Windows Server 2016 and Windows Server 2019. Flaws listed only under those names are counted on their own pages, not here. Open the release you run to see its own list.

### How do I get alerts for Windows?

Create a Precursor Intelligence account and track Windows. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook.

## Running Windows?

Precursor Intelligence keeps checking for you:

- **Tell us what you run.** Pick your software from a list, or let us work it out from your website.
- **We match it to every flaw.** Over 400,000 published flaws, checked against your list.
- **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it.
- **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools.

Start free (no card, nothing to install): https://www.precursorintelligence.com/register
Book a demo: https://www.precursorintelligence.com/contact