# Windows security incidents · pwn.watch

> Security incidents tagged Windows (vendor, product, platform or attack type).

Page: https://pwn.watch/t/windows · generated 2026-10-22T17:40:31.642Z

## Status (as of 2026-10-22)
- Incidents: 55 (1 live, 0 live and not fully patched, 55 patched)
- Days without a Windows security incident: 3
- Newest incident started: 2026-10-19

## Feeds
- JSON (incidents + changes + posts): https://pwn.watch/t/windows.json
- RSS (one item per incident, bumped on each update): https://pwn.watch/t/windows/feed.xml
- This file: https://pwn.watch/t/windows/llms.txt
- Whole site: https://pwn.watch/llms.txt · all tags: https://pwn.watch/tags.json

## Incidents (newest first by start date)
- [OpenCode: malicious MCP server can run code on Windows/WSL during sign-in (no CVE)](https://pwn.watch/i/opencode-mcp-oauth-rce-windows) ([json](https://pwn.watch/i/opencode-mcp-oauth-rce-windows.json)): critical, live, patched, started 2026-10-19
- [Windows Shell Mark-of-the-Web bypass zero-day (CVE-2026-96951)](https://pwn.watch/i/windows-shell-cve-2026-96951-motw) ([json](https://pwn.watch/i/windows-shell-cve-2026-96951-motw.json)): high, closed, patched, started 2026-10-13, CVE-2026-96951, CVE-2026-108398, CVE-2026-92707
- [Microsoft Windows: Microsoft Windows Link Following Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-81963) ([json](https://pwn.watch/i/microsoft-windows-cve-2026-81963.json)): high, closed, patched, started 2026-09-08, CVE-2026-81963, CVE-2026-85880
- [Microsoft Windows Ancillary Function Driver for WinSock : Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability](https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820) ([json](https://pwn.watch/i/microsoft-windows-ancillary-function-driver-for-winsock-cve-2026-68820.json)): high, closed, patched, started 2026-08-11, CVE-2026-68820
- [Microsoft Windows: Microsoft Windows Protection Mechanism Failure Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-32202) ([json](https://pwn.watch/i/microsoft-windows-cve-2026-32202.json)): high, closed, patched, started 2026-04-28, CVE-2026-32202
- [Microsoft Windows: Microsoft Windows Link Following Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-60710) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-60710.json)): high, closed, patched, started 2026-04-13, CVE-2025-60710, CVE-2023-36424
- [Microsoft Windows: Microsoft MSHTML Framework Protection Mechanism Failure Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-21513) ([json](https://pwn.watch/i/microsoft-windows-cve-2026-21513.json)): high, closed, patched, started 2026-02-10, CVE-2026-21513, CVE-2026-21525, CVE-2026-21510…
- [React Native Community CLI: React Native Community CLI OS Command Injection Vulnerability](https://pwn.watch/i/react-native-community-cli-cve-2025-11953) ([json](https://pwn.watch/i/react-native-community-cli-cve-2025-11953.json)): high, closed, patched, started 2026-02-05, CVE-2025-11953
- [Microsoft Windows: Microsoft Windows Information Disclosure Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2026-20805) ([json](https://pwn.watch/i/microsoft-windows-cve-2026-20805.json)): high, closed, patched, started 2026-01-13, CVE-2026-20805
- [Microsoft Windows: Windows Use After Free Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-62221) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-62221.json)): high, closed, patched, started 2025-12-09, CVE-2025-62221
- [Microsoft Windows: Windows Race Condition Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-62215) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-62215.json)): high, closed, patched, started 2025-11-12, CVE-2025-62215
- [Microsoft Windows: Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-59287) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-59287.json)): critical, closed, patched, started 2025-10-24, CVE-2025-59287
- [Microsoft Windows: Windows SMB Client Improper Access Control Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-33073) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-33073.json)): high, closed, patched, started 2025-10-20, CVE-2025-33073
- [Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-24990, CVE-2025-59230)](https://pwn.watch/i/microsoft-windows-cve-2025-24990) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-24990.json)): high, closed, patched, started 2025-10-14, CVE-2025-24990, CVE-2025-59230
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2011-3402, CVE-2013-3918, CVE-2021-43226)](https://pwn.watch/i/microsoft-windows-cve-2011-3402) ([json](https://pwn.watch/i/microsoft-windows-cve-2011-3402.json)): critical, closed, patched, started 2025-10-06, CVE-2011-3402, CVE-2013-3918, CVE-2021-43226
- [Citrix Session Recording: 2 exploited vulnerabilities (CVE-2024-8068, CVE-2024-8069)](https://pwn.watch/i/citrix-session-recording-cve-2024-8068) ([json](https://pwn.watch/i/citrix-session-recording-cve-2024-8068.json)): medium, closed, patched, started 2025-08-25, CVE-2024-8068, CVE-2024-8069
- [RARLAB WinRAR: WinRAR Path Traversal Vulnerability](https://pwn.watch/i/rarlab-winrar-cve-2025-8088) ([json](https://pwn.watch/i/rarlab-winrar-cve-2025-8088.json)): critical, closed, patched, started 2025-08-12, CVE-2025-8088
- [eslint-config-prettier and friends hijacked via npnjs.com phishing (CVE-2025-54313)](https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313) ([json](https://pwn.watch/i/eslint-config-prettier-npm-phishing-cve-2025-54313.json)): high, closed, patched, started 2025-07-18, CVE-2025-54313
- [Microsoft Windows: Microsoft Windows External Control of File Name or Path Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-33053) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-33053.json)): high, closed, patched, started 2025-06-10, CVE-2025-33053
- [Microsoft Windows: 5 exploited vulnerabilities (CVE-2025-30397, CVE-2025-30400, CVE-2025-32701, CVE-2025-32706, CVE-2025-32709)](https://pwn.watch/i/microsoft-windows-cve-2025-30397) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-30397.json)): high, closed, patched, started 2025-05-13, CVE-2025-30397, CVE-2025-30400, CVE-2025-32701…
- [Microsoft Windows: Windows NTLM Hash Disclosure Spoofing Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-24054) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-24054.json)): medium, closed, patched, started 2025-04-17, CVE-2025-24054
- [Microsoft Windows: Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2025-29824) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-29824.json)): critical, closed, patched, started 2025-04-08, CVE-2025-29824
- [Microsoft Windows: 6 exploited vulnerabilities (CVE-2025-24983, CVE-2025-24984, CVE-2025-24985, CVE-2025-24991, CVE-2025-24993, CVE-2025-26633)](https://pwn.watch/i/microsoft-windows-cve-2025-24983) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-24983.json)): critical, closed, patched, started 2025-03-11, CVE-2025-24983, CVE-2025-24984, CVE-2025-24985…
- [Microsoft Windows: Windows Win32k Improper Resource Shutdown or Release Vulnerability](https://pwn.watch/i/microsoft-windows-cve-2018-8639) ([json](https://pwn.watch/i/microsoft-windows-cve-2018-8639.json)): critical, closed, patched, started 2025-03-03, CVE-2018-8639
- [Microsoft Windows: 2 exploited vulnerabilities (CVE-2025-21391, CVE-2025-21418)](https://pwn.watch/i/microsoft-windows-cve-2025-21391) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-21391.json)): high, closed, patched, started 2025-02-11, CVE-2025-21391, CVE-2025-21418
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2025-21333, CVE-2025-21334, CVE-2025-21335)](https://pwn.watch/i/microsoft-windows-cve-2025-21333) ([json](https://pwn.watch/i/microsoft-windows-cve-2025-21333.json)): high, closed, patched, started 2025-01-14, CVE-2025-21333, CVE-2025-21334, CVE-2025-21335
- [Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow](https://pwn.watch/i/microsoft-windows-cve-2024-49138) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-49138.json)): high, closed, patched, started 2024-12-10, CVE-2024-49138
- [Microsoft November 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039) ([json](https://pwn.watch/i/microsoft-zero-days-november-2024-43451-49039.json)): high, closed, patched, started 2024-11-12, CVE-2024-43451, CVE-2024-49039
- [Microsoft October 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573) ([json](https://pwn.watch/i/microsoft-zero-days-october-2024-43572-43573.json)): high, closed, patched, started 2024-10-08, CVE-2024-43572, CVE-2024-43573
- [Microsoft Windows MSHTML Platform Spoofing](https://pwn.watch/i/microsoft-windows-cve-2024-43461) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-43461.json)): high, closed, patched, started 2024-09-10, CVE-2024-43461
- [Microsoft September 2024: 3 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more) ([json](https://pwn.watch/i/microsoft-zero-days-september-2024-38014-38217-and-1-more.json)): high, closed, patched, started 2024-09-10, CVE-2024-38014, CVE-2024-38217, CVE-2024-38226
- [Kingsoft WPS Office Path Traversal](https://pwn.watch/i/kingsoft-wps-office-cve-2024-7262) ([json](https://pwn.watch/i/kingsoft-wps-office-cve-2024-7262.json)): critical, closed, patched, started 2024-08-15, CVE-2024-7262
- [Microsoft August 2024: 6 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more) ([json](https://pwn.watch/i/microsoft-zero-days-august-2024-38106-38107-and-4-more.json)): high, closed, patched, started 2024-08-13, CVE-2024-38106, CVE-2024-38107, CVE-2024-38178…
- [Microsoft COM for Windows Deserialization of Untrusted Data](https://pwn.watch/i/microsoft-windows-cve-2018-0824) ([json](https://pwn.watch/i/microsoft-windows-cve-2018-0824.json)): high, closed, patched, started 2024-08-05, CVE-2018-0824
- [CrowdStrike Falcon update crashes 8.5 million Windows machines](https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage) ([json](https://pwn.watch/i/crowdstrike-falcon-channel-file-291-outage.json)): critical, closed, patched, started 2024-07-19
- [Microsoft July 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112) ([json](https://pwn.watch/i/microsoft-zero-days-july-2024-38080-38112.json)): high, closed, patched, started 2024-07-09, CVE-2024-38080, CVE-2024-38112
- [Microsoft Windows Kernel TOCTOU Race Condition](https://pwn.watch/i/microsoft-windows-cve-2024-30088) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-30088.json)): high, closed, patched, started 2024-06-11, CVE-2024-30088
- [Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference](https://pwn.watch/i/microsoft-windows-cve-2024-35250) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-35250.json)): high, closed, patched, started 2024-06-11, CVE-2024-35250
- [PHP-CGI argument injection on Windows (CVE-2024-4577)](https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577) ([json](https://pwn.watch/i/php-cgi-argument-injection-cve-2024-4577.json)): critical, closed, patched, started 2024-06-06, CVE-2024-4577
- [Microsoft May 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051) ([json](https://pwn.watch/i/microsoft-zero-days-may-2024-30040-30051.json)): high, closed, patched, started 2024-05-14, CVE-2024-30040, CVE-2024-30051
- [Microsoft Windows Print Spooler Privilege Escalation](https://pwn.watch/i/microsoft-windows-cve-2022-38028) ([json](https://pwn.watch/i/microsoft-windows-cve-2022-38028.json)): high, closed, patched, started 2024-04-23, CVE-2022-38028
- [Microsoft Windows Error Reporting Service Improper Privilege Management](https://pwn.watch/i/microsoft-windows-cve-2024-26169) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-26169.json)): high, closed, patched, started 2024-03-12, CVE-2024-26169
- [Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control](https://pwn.watch/i/microsoft-windows-cve-2024-21338) ([json](https://pwn.watch/i/microsoft-windows-cve-2024-21338.json)): high, closed, patched, started 2024-02-13, CVE-2024-21338
- [Microsoft February 2024: 2 actively exploited zero-days](https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412) ([json](https://pwn.watch/i/microsoft-zero-days-february-2024-21351-21412.json)): high, closed, patched, started 2024-02-13, CVE-2024-21351, CVE-2024-21412
- [Microsoft Windows: Mark of the Web (MOTW) Security Feature Bypass (CVE-2023-36584)](https://pwn.watch/i/microsoft-windows-cve-2023-36584) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-36584.json)): medium, closed, patched, started 2023-11-16, CVE-2023-36584
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-36025, CVE-2023-36033, CVE-2023-36036)](https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-36025-36033-36036.json)): high, closed, patched, started 2023-11-14, CVE-2023-36025, CVE-2023-36033, CVE-2023-36036
- [Microsoft Windows CNG Key Isolation Service: Privilege Escalation (CVE-2023-28229)](https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229) ([json](https://pwn.watch/i/microsoft-windows-cng-key-isolation-service-cve-2023-28229.json)): high, closed, patched, started 2023-10-04, CVE-2023-28229
- [WinRAR zero-day used against traders, then state hackers (CVE-2023-38831)](https://pwn.watch/i/winrar-zero-day-cve-2023-38831) ([json](https://pwn.watch/i/winrar-zero-day-cve-2023-38831.json)): high, closed, patched, started 2023-08-02, CVE-2023-38831
- [Microsoft Windows: Search Remote Code Execution (CVE-2023-36884)](https://pwn.watch/i/microsoft-windows-cve-2023-36884) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-36884.json)): high, closed, patched, started 2023-07-17, CVE-2023-36884
- [Microsoft Windows: 3 exploited vulnerabilities (CVE-2023-32046, CVE-2023-32049, CVE-2023-36874)](https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-32046-32049-36874.json)): high, closed, patched, started 2023-07-11, CVE-2023-32046, CVE-2023-32049, CVE-2023-36874
- [Microsoft Windows: Common Log File System (CLFS) Driver Privilege Escalation (CVE-2023-28252)](https://pwn.watch/i/microsoft-windows-cve-2023-28252) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-28252.json)): high, closed, patched, started 2023-04-11, CVE-2023-28252
- [3CX DesktopApp supply-chain attack (trojanized signed builds)](https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023) ([json](https://pwn.watch/i/3cx-desktopapp-supply-chain-attack-2023.json)): critical, closed, patched, started 2023-03-29, CVE-2023-29059
- [Microsoft Windows: SmartScreen Security Feature Bypass (CVE-2023-24880)](https://pwn.watch/i/microsoft-windows-cve-2023-24880) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-24880.json)): medium, closed, patched, started 2023-03-14, CVE-2023-24880
- [Microsoft Windows: 2 exploited vulnerabilities (CVE-2023-21823, CVE-2023-23376)](https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-21823-23376.json)): high, closed, patched, started 2023-02-14, CVE-2023-21823, CVE-2023-23376
- [Microsoft Windows: Advanced Local Procedure Call (ALPC) Privilege Escalation (CVE-2023-21674)](https://pwn.watch/i/microsoft-windows-cve-2023-21674) ([json](https://pwn.watch/i/microsoft-windows-cve-2023-21674.json)): high, closed, patched, started 2023-01-10, CVE-2023-21674