Microsoft Windows — Security Intelligence & Vulnerability Profile

Doctrinal Security Principle

The absence of known CVEs does not guarantee absolute security of a software component. This dossier catalogs verified vulnerabilities, CISA KEV entries, and vendor advisories vetted by Hermes Codex.

---

1. Software Identity & Security Posture

Parameter	Technical Specification
Official Name	Microsoft Windows
Vendor / Project	microsoft
Canonical ID	microsoft:windows
Versioning Scheme	generic
CPE Identifiers	cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_10:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_11:*:*:*:*:*:*:*:* cpe:2.3:o:microsoft:windows_server:*:*:*:*:*:*:*:*
Overall Posture	CRITICAL
Recommended Safe Release	KB5051234 (Windows July 2025 Security Update)

Documented CVEs

25 vulnerabilities cataloged in the Hermes intelligence repository.

CISA KEV Entries

9 flaws with confirmed active in-the-wild exploitation.

Weaponized Exploits

24 vulnerabilities with publicly available PoCs or weaponized exploit tooling.

Remediation Target

Recommended upgrade to KB5051234 (Windows July 2025 Security Update) to neutralize known flaws.

---

2. 30-Day Risk Trajectory & Trend Evolution

Progression of Hermes Threat Score (HTS) posture and maximum EPSS probability over the last 30 days:

Current HTS Score

0 / 100

= Stable over 30d

Max EPSS (Exploitation)

77.2 %

= Stable over 30d

CISA KEV Activity

9

Active in-the-wild exploitation

HTS Trend Curve (D-30 → Today)2026-08-12 → 2026-09-10

---

3. Vulnerability History & Version Applicability Matrix

CVE	CVSS Score	EPSS Probability	CISA KEV	Affected Versions	Fixed In	Hermes Analysis
CVE-2026-69579	9.8 (CRITICAL)	1.0%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-69595	9.8 (CRITICAL)	1.0%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-69730	9.8 (CRITICAL)	1.0%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-69845	9.8 (CRITICAL)	0.9%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-72979	9.8 (CRITICAL)	1.0%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-72982	9.8 (CRITICAL)	0.9%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-73009	9.8 (CRITICAL)	0.9%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-77493	9.8 (CRITICAL)	1.0%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-78445	9.8 (CRITICAL)	0.9%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-78509	9.8 (CRITICAL)	1.0%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-69518	8.8 (CRITICAL)	0.8%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-69603	8.8 (CRITICAL)	0.3%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-69676	8.8 (CRITICAL)	1.1%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-80083	8.8 (CRITICAL)	0.2%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2021-42278	8.8 (HIGH)	73.3%	CISA KEV	All versions, All versions, All versions, All versions	KB5008102, KB5008380	Analysis →
CVE-2021-42287	8.8 (HIGH)	77.2%	CISA KEV	All versions, All versions, All versions, All versions	KB5008102, KB5008380	Analysis →
CVE-2026-72961	8.2 (HIGH)	0.3%	No	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-21510	7.8 (HIGH)	26.2%	CISA KEV	< v10.0.26100.1882	10.0.26100.1882	Analysis →
CVE-2026-33825	7.8 (HIGH)	6.7%	CISA KEV	< v1.1.24080.9	1.1.24080.9	Analysis →
CVE-2026-81963	7.8 (HIGH)	0.6%	CISA KEV	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2026-85880	7.8 (HIGH)	0.6%	CISA KEV	< v10.0.19045.5780, < v10.0.22631.5280, < v10.0.26100.3800	10.0.19045.5780, 10.0.22631.5280, 10.0.26100.3800	Analysis →
CVE-2025-29824	7.8 (HIGH)	13.9%	CISA KEV	< v10.0.19045.5728, < v10.0.22631.5206, < v10.0.26100.3750	10.0.19045.5728, 10.0.22631.5206, 10.0.26100.3750	Analysis →
CVE-2025-21333	7.8 (HIGH)	10.0%	CISA KEV	< v10.0.19045.5371, < v10.0.22631.4751, < v10.0.26100.2894	10.0.19045.5371, 10.0.22631.4751, 10.0.26100.2894	Analysis →
CVE-2025-32724	7.5 (HIGH)	1.8%	No	< v10.0.10240.21034	KB5051234 (Windows July 2025 Security Update)	Analysis →
CVE-2025-24054	6.5 (MEDIUM)	58.9%	CISA KEV	< v10.0.19045.5609, < v10.0.22631.5039, < v10.0.26100.3476	10.0.19045.5609, 10.0.22631.5039, 10.0.26100.3476	Analysis →

---

4. Ransomware & Threat Actor Exposure

Vulnerabilities impacting Microsoft Windows are actively leveraged in real-world intrusion campaigns:

• CVE-2021-42278: https://nvd.nist.gov/vuln/detail/CVE-2021-42278 (Read deep dive analysis)
• CVE-2021-42287: https://nvd.nist.gov/vuln/detail/CVE-2021-42287 (Read deep dive analysis)
• CVE-2026-21510: Known in opportunistic exploitation (Read deep dive analysis)
• CVE-2026-33825: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-33825 ; https://nvd.nist.gov/vuln/detail/CVE-2026-33825 (Read deep dive analysis)
• CVE-2026-81963: Unknown (Read deep dive analysis)
• CVE-2026-85880: Unknown (Read deep dive analysis)
• CVE-2025-29824: https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2025-29824 ; https://nvd.nist.gov/vuln/detail/CVE-2025-29824 (Read deep dive analysis)
• CVE-2025-21333: Unknown (Read deep dive analysis)
• CVE-2025-24054: Unknown (Read deep dive analysis)

---

5. Evaluate Running Versions in Interactive Workbench

Are you operating Microsoft Windows in your infrastructure? Inspect your running build to evaluate applicability, confidence score, and security deltas:

Launch Software Intelligence Workbench for Microsoft Windows Run deterministic in-browser evaluation, calculate HTS threat reduction, and plan your upgrade path.