Windows CVE Tracker 2025-2026
Unpatched Vulnerabilities & Actively Exploited Zero-Days
A live tracker of real Windows CVEs from 2025 and 2026 β focusing on vulnerabilities that are either unpatched, actively exploited in the wild, or critical enough to demand immediate attention. All data sourced from CISA KEV, MSRC, and NVD. Updated after each Microsoft Patch Tuesday and whenever new zero-days drop.
Your own Protection history β every threat Defender blocked or quarantined on this device. The first place to check after a suspicious event.
Active Zero-Days β Exploited in the Wild (2025-2026)
These vulnerabilities were exploited as zero-days in the wild before patches were available. One remains without a formal security update. If you run Windows 10, 11, or Server, verify your patch status against the dates below and apply mitigations where noted.
Windows Common Log File System (CLFS) Driver Elevation of Privilege Vulnerability
A use-after-free vulnerability (CWE-416) in the Windows Common Log File System (CLFS) kernel driver (clfs.sys). A local attacker running as a standard user can exploit a race condition in CLFS log handle cleanup to corrupt kernel memory and escalate privileges to SYSTEM. Microsoft Threat Intelligence attributed exploitation to Storm-2460, which deployed the exploit via PipeMagic malware to deliver RansomEXX ransomware. Targets included IT and real estate organizations in the U.S., financial sector in Venezuela, a Spanish software company, and Saudi retail. CISA added to KEV on April 8, 2025 with a remediation deadline of April 29, 2025.
Apply April 2025 Patch Tuesday updates (KB5055523 and related). CISA KEV remediation deadline was April 29, 2025. CLFS driver vulnerabilities are a recurring target for ransomware operators β prioritize patching elevation of privilege flaws on all endpoints and servers.
Windows BitLocker Security Feature Bypass Vulnerability
An attacker with physical access to a powered-off Windows device can bypass BitLocker encryption and access the system volume without the PIN, password, or recovery key. The exploit abuses the FsTx Auto Recovery Utility (autofstx.exe) in the Windows Recovery Environment (WinRE) β crafted contents on a USB drive trigger a command injection that drops the attacker into a CMD prompt with the BitLocker volume mounted. Microsoft has released mitigation guidance but no full security update. TPM+PIN configurations are not exploitable.
Require TPM + PIN for BitLocker pre-boot authentication β TPM+PIN is not exploitable. Alternatively, remove autofstx.exe from the WinRE image's BootExecute registry value using Microsoft's mitigation script. Configure via Group Policy: Computer Configuration β Administrative Templates β Windows Components β BitLocker Drive Encryption β Operating System Drives β Require additional authentication at startup β Enabled (require PIN with TPM).
Microsoft Windows LNK File UI Misrepresentation Remote Code Execution Vulnerability
A User Interface Misrepresentation of Critical Information vulnerability (CWE-451) in how Windows handles .LNK shortcut files. Attackers pad the Target field with whitespace to hide malicious command-line arguments β Windows only displayed the first 260 characters in the Properties view, concealing the true payload. Exploited by at least 11 APT groups since 2017, including North Korean, Russian, and Chinese threat actors. Microsoft initially refused to patch, saying it "did not meet the bar for servicing." The company silently mitigated the flaw in November 2025 updates, but no formal security update was issued.
Install November 2025 or later Windows updates β Windows now displays the entire Target field string in shortcut file properties. Block or restrict .lnk files from untrusted origins. Train users to be cautious with shortcut files delivered in ZIP archives. Microsoft Defender has detections for known malicious .lnk exploitation patterns. Smart App Control provides an additional layer of protection on supported systems.
Actively Exploited Zero-Days (Now Patched)
These vulnerabilities were exploited in the wild before patches were available. If you haven't applied the relevant Patch Tuesday updates, you are still vulnerable. Check your Windows Update history against the patch dates below.
Double-Free RCE in Windows IKE Extension (ikeext.dll)
A pre-authentication double-free in the IKEv2 fragment-reassembly path, reachable on UDP 500/4500 against any Windows IKEv2 responder. An unauthenticated, remote attacker can execute arbitrary code at SYSTEM privilege with no user interaction. Considered wormable. Exploited by threat group "BlueHammer" before the patch was available. Added to CISA KEV on August 18, 2026.
Apply April 2026 Patch Tuesday updates immediately if not already installed. If IKE/IPsec VPN is not needed, block inbound UDP 500 and 4500 at the firewall. If IKE is required, restrict inbound to known peer IPs only.
Use-After-Free in Windows Ancillary Function Driver for WinSock (afd.sys)
Exploited by North Korea's Lazarus Group for at least 5 weeks before Microsoft patched it on August 11, 2026. The exploit was incorporated into the FudModule kernel-mode rootkit to elevate privileges. Targeted defense, aerospace, and aviation companies across Europe and India. The only confirmed in-the-wild exploited zero-day in August 2026 Patch Tuesday (421 CVEs total).
Apply August 2026 Patch Tuesday updates. CISA remediation deadline was August 25, 2026 for federal agencies. If you work in defense, aerospace, or aviation, assume you may have been targeted and check for FudModule rootkit indicators.
Privilege Escalation in Microsoft Malware Protection Engine
An improper link resolution flaw in Defender's scan engine. A low-privileged attacker manipulates a symbolic link or directory junction during a Defender scan to escalate to SYSTEM. Confirmed exploited by Huntress incident responders beginning mid-April 2026 β a 6-week window with no patch. Part of the Nightmare Eclipse series (variant of BlueHammer).
Verify Defender engine version is 1.1.26040.8 or later. Check in Windows Security β Virus & threat protection β About. If outdated, force a manual definition update.
Denial of Service β Silently Disables Microsoft Defender
A DoS flaw that allows a local attacker to block Defender's signature and engine updates, making it appear operational while actually outdated and ineffective. No visible alert to the user or admin during exploitation. Enables stealthy persistence post-compromise β Defender won't detect follow-on attacks. Low CVSS but high operational impact: silencing endpoint detection is an enabler for ransomware deployment.
Verify Defender platform version is 4.18.26040.7 or later. Regularly verify that definition updates are actually being applied β don't just check if Defender "appears" to be running.
TOCTOU Race Condition in Defender Scan Engine
A Time-of-Check to Time-of-Use race condition in the Microsoft Malware Protection Engine (mpengine.dll) that allows a standard user to escalate to SYSTEM using virtual disks and NT native file manipulation. Patched in July 2026, but the patch was fully bypassed by ShieldBreak (CVE-2026-69414) on August 12, 2026. Even systems with the RoguePlanet patch applied remain vulnerable.
The July patch is installed but bypassed. See CVE-2026-69414 (ShieldBreak) above for current mitigation guidance. This CVE is listed for historical context β the underlying vulnerability class remains unpatched.
Privilege Escalation to SYSTEM in Windows Defender
The first in the Nightmare Eclipse series. Exploited in the wild four days before the April 2026 Patch Tuesday fix was released. This kicked off the researcher's campaign of dropping Windows zero-days immediately after each Patch Tuesday to maximize the unpatched window.
Apply April 2026 Patch Tuesday updates. This is the first in a series β ensure all subsequent patches through August 2026 are also applied.
Windows Update history is your ground truth for what patches you've actually installed. Verify recent CVE fixes here.
Critical Vulnerabilities Patched in August 2026
August 2026 Patch Tuesday fixed 421 vulnerabilities β one of the largest releases ever. These are the critical ones that demand immediate attention even if not actively exploited.
Use-After-Free RCE in Microsoft QUIC Protocol (MsQuic)
A use-after-free in Microsoft's QUIC implementation (msquic.sys) allows an unauthenticated remote attacker to execute arbitrary code by sending crafted network packets. Affects HTTP/3 and SMB over QUIC. No user interaction required. CVSS 9.8 β critical. Not yet in CISA KEV but demands immediate patching for any internet-facing Windows system.
Apply August 2026 Patch Tuesday. If QUIC/HTTP/3 is not needed, block inbound UDP 443 at the firewall as defense-in-depth. Fixed builds: Win 11 24H2 β 10.0.26100.9168, 25H2 β 10.0.26200.9168.
Elevation of Privilege β Publicly Disclosed Before Patch
An elevation of privilege vulnerability that was publicly disclosed before the August 2026 patch was released. Publicly disclosed CVEs have a higher risk of exploitation since the details are known to attackers before the fix is widely deployed.
Apply August 2026 Patch Tuesday updates immediately.
Elevation of Privilege β Publicly Disclosed Before Patch
Second elevation of privilege vulnerability publicly disclosed before the August 2026 patch. Prioritize patching on multi-user workstations and shared systems where local attack vectors are a primary concern.
Apply August 2026 Patch Tuesday updates. Prioritize multi-user workstations and terminal servers.
The Nightmare Eclipse saga β 6+ Defender zero-days in 8 months, each patch quickly bypassed by a new exploit.
The Nightmare Eclipse Zero-Day Campaign
Since April 2026, a pseudonymous researcher known as "Nightmare Eclipse" (also "Chaotic Eclipse") β suspected to be a former disgruntled Microsoft employee β has been publicly dropping Windows zero-day exploits immediately after each Patch Tuesday. Microsoft banned the researcher's GitHub account on May 23, 2026. The researcher claims Microsoft failed to compensate them and has threatened further releases. This is the full timeline.
Why This Matters for You
The Nightmare Eclipse campaign has exposed a pattern: Windows Defender and BitLocker have systemic weaknesses that Microsoft patches reactively but doesn't fix at the root. ShieldBreak bypassed the RoguePlanet patch in weeks. YellowKey and GreatXML both bypass BitLocker through WinRE. If you rely on Windows Defender as your sole endpoint protection, or on TPM-only BitLocker without a PIN, you are exposed to known, public exploit techniques.
Key takeaways:
- Don't rely on Windows Defender alone β add a second opinion scanner or EDR
- Always require TPM + PIN for BitLocker, never TPM-only
- Apply patches within 72 hours of Patch Tuesday, not the default 7-day delay
- Monitor for new zero-day drops after each Patch Tuesday (second Tuesday of the month)
- Run as standard user, not local admin β most of these exploits require a local foothold
Timeline: 10 Zero-Days in 5 Months
BlueHammer (CVE-2026-33825) β Patched same day
First drop. Defender EoP to SYSTEM. Exploited 4 days before patch.
YellowKey (CVE-2026-45585) β Unpatched
BitLocker bypass via WinRE. Physical access. PoC on GitHub.
GreenPlasma β Unpatched
CTFMON LPE. Partial PoC. UAC bypass withheld.
RedSun (CVE-2026-41091) β Patched after 6 weeks
Defender EoP. Actively exploited by attackers before patch.
UnDefend (CVE-2026-45498) β Patched after 6 weeks
Defender DoS. Silently disables AV. Actively exploited.
MiniPlasma β Unpatched
cldflt.sys LPE to SYSTEM on fully patched Win 11.
GreatXML β Unpatched
BitLocker bypass via crafted XML on recovery partition.
RoguePlanet (CVE-2026-50656) β Patched July 9
Defender TOCTOU race to SYSTEM. Later bypassed by ShieldBreak.
RoguePlanet Patch Released
Microsoft patches RoguePlanet. Brief respite.
ShieldBreak (CVE-2026-69414) β Unpatched
Full bypass of RoguePlanet patch. 10th zero-day. CISA BOD 26-04. 100% success rate.
Disclaimer: This tracker is compiled from public sources including CISA KEV, Microsoft Security Response Center, BleepingComputer, SecurityWeek, The Register, and security vendor blogs. Patch status changes rapidly β always verify against the Microsoft Security Response Center and CISA KEV catalog for the latest status. Last updated: September 1, 2026.
Worried About Your Windows Exposure?
With 5 unpatched zero-days and a researcher actively dropping new exploits every month, Windows security in 2026 requires active defense β not just "set it and forget it." I can audit your Windows systems, apply CIS-aligned hardening, configure BitLocker with TPM+PIN, and set up monitoring for these active threats.