Windows 10, one year on: the security fixes a non-ESU PC did not receive

What this counts, and what it does not say

• The word 'unpatched' is not used. Microsoft shipped a fix for every CVE counted here. The only accurate framing is 'fixes a non-ESU machine did not receive'.
• No ransomware framing. None of the exploited flaws carries CISA's 'Known' ransomware-campaign flag.
• No superlatives and no 'first ever' claim. See the novelty note.
• The population is Windows 10 Home and Pro 22H2 without ESU. Nothing here describes 21H2 or the LTSC editions.
• As at 20 September 2026. CVE records are revised continuously, so counts for past months rise over time. Everything here is computed from a frozen, hashed snapshot of the CVE Program's bulk release of 20 September 2026 and the CISA KEV catalogue v2026.09.18. Re-running the same filter on a later release will give a larger number, which is a property of the source, not a correction to this one.

The pre-registered floor of 1,204 does not survive. 8 of the 11 months match it within one CVE; November 2025 and December 2025 are two out; and September 2026 is 285 out, where the brief expected 283 and the CVE records give 568. The brief's own alternative estimate, about 1,500 from Microsoft's affected lists, is what the data supports. The published figure is 1,486. Every month is set out against the brief below. This is recorded rather than quietly corrected, because the brief was written before the data was pulled and the filter is published so anyone can recount.

Scroll the table sideways to see every column →

What was measured

Support for Windows 10 Home and Pro ended on 14 October 2025. From 15 October 2025 the monthly Windows security update for version 22H2 went only to machines enrolled in Extended Security Updates. This study counts the fixes in those updates.

The unit is one CVE. The population is every CVE published by the Microsoft CNA between 2025-10-15 and 2026-09-20 whose CVE Program v5 'affected' array names "Windows 10 Version 22H2" as a vulnerable component, minus those the last free update of 14 October 2025 had already fixed.

Microsoft shipped a fix for every one of them. The question is only which machines received it. Nothing here says Windows 10 was left without a patch.

Scroll the table sideways to see every column →

Inclusion test, published so the count can be re-run: cveMetadata.assignerShortName == 'microsoft' AND cveMetadata.state == 'PUBLISHED' AND containers.cna.datePublic >= 2025-10-15 AND containers.cna.affected[] contains an entry with product == 'Windows 10 Version 22H2' (exact string, case-insensitive) carrying a versions[] item with status 'affected'. Every percentage states its denominator. No percentage is published on a count below 10; those cuts say so. Percentages are rounded to one decimal place and may not sum to 100.

The count, month by month

1486 fixes across 11 months. The monthly bars are the observations; the curve above them is only their running total. Both are published because the running total is what a machine accumulates and the bars are what the series actually looks like.

Monthly counts run from 24 (February 2026) to 568 (September 2026), with a median of 70. That is a factor of 23.7 between the smallest and largest month, so this study publishes the median and the range and makes no claim about a monthly rate.

The large months are broad across components, not one component arriving in a batch. September 2026 alone is 568 of the 1486, spread over 184 distinct components: its largest single block is Windows Biometric Service at 64, 11.3 per cent of the month, and its five largest components together are 140. July 2026 is the same shape - Windows Kernel is the largest at 25 of 313. No component accounts for more than a fifth of any month in the series. Why September 2026 is as large as it is cannot be answered from the CVE records, and no explanation is offered here.

These are distinct CVE identifiers, checked for duplicates, not one flaw counted many times.

Scroll the table sideways to see every column →

“Microsoft’s own figure” is the count of CVEs Microsoft’s Security Update Guide lists as affecting Windows 10 Version 22H2 in that month. Cited from Microsoft's Security Update Guide, not reproduced: aggregate counts only. No per-CVE row from that source appears in the published dataset or here. Across the eleven months it totals 1,500 against this study’s 1,486. All 14 of them are individually accounted for and none is a filter error. 10 are not Microsoft-CNA records at all: their CVE records are assigned by CERT/CC (3), MITRE (3), GitHub (2), AMD (1) and Arm (1), and Microsoft relays them because a Microsoft update carries the fix. The other four were already fixed by the free 14 October 2025 update. The CVE Program set is a strict subset of Microsoft's: nothing is in this study's population and absent from Microsoft's list. All fourteen are named below, in the dataset README and in this study's JSON.

What kind of flaws

By Microsoft's own CVSS v3.1 scoring inside the CVE records, 38 of the 1486 are Critical and 1102 are High.

By vulnerability class, elevation of privilege dominates: these are mostly flaws that let code already running on the machine gain more control, rather than flaws an attacker reaches across the internet unaided.

The largest component family is Networking and protocols, 286 of 1486 (19.2 per cent).

Families with fewer than ten fixes are left off the chart and listed here with counts but no share, in line with the study’s rule against percentages on small counts: Office file handling in Windows (3); Third-party silicon mitigations (2); Other Windows component (1).

Flaws already being exploited

12 of the 1486 fixes are for flaws CISA has since listed in its Known Exploited Vulnerabilities catalogue.

For 9 of those 12, CISA listed the flaw as actively exploited on the same calendar day the fix shipped. CISA adds an entry only on evidence of active exploitation, so same-day listing means exploitation was already known when the update went out. It does not establish that any particular machine was attacked, and the arithmetic is date-only - it cannot resolve hours.

None of these carries CISA's 'Known' ransomware-campaign flag. All are flagged 'Unknown', which means not established rather than not used.

Scroll the table sideways to see every column →

Two independent routes give the same set: the CISA-ADP SSVC Exploitation field carried inside the CVE records, and a direct join to the KEV catalogue. They are different signals by definition and agreeing here is a result, not a guarantee. Both routes return the same 12 identifiers. Microsoft’s own “exploited” flag, cited from the Security Update Guide, marks 11 of them; the two overlap on 11.

• KEV is a floor, not a census. Absence from KEV is not evidence that a flaw was not exploited.
• KEV listings are retroactive. One entry here, CVE-2026-33824, was added 126 days after publication, so the figure for recent months will rise after this snapshot.
• Each KEV entry carries a dueDate. That is a United States federal compliance deadline under CISA Binding Operational Directive 22-01. It has no force for a UK household and is not presented here as one.

Does paying for ESU deliver all of them?

On the evidence available, yes - with one documented boundary that cannot be tested from public data. Every one of the 1500 CVEs in Microsoft's own Windows 10 22H2 list for these months carries a shipped 22H2 vendor-fix KB in Microsoft's Security Update Guide, with no exceptions in any of the eleven months. There is no set of fixes that simply never shipped.

That boundary is the stated severity scope. Microsoft states that ESU delivers Critical- and Important-rated security updates only, and the Microsoft Security Response Center rates on four levels. In this window Microsoft rates 2 of the 1500 as Moderate, outside that stated scope - too few to express as a share. Those two fixes ship in the same monthly cumulative update as the rest, so whether ESU withholds them is not observable from anything Microsoft publishes. No claim is made here that an ESU subscriber misses anything.

Scroll the table sideways to see every column →

Microsoft's own Critical/Important/Moderate/Low rating, from the Security Update Guide. Cited, not reproduced: this source carries no open licence and its rows are not in the published dataset. Denominator is Microsoft's own total, which is larger than this study's CVE Program population. This is why the word 'unpatched' does not appear in this study. Microsoft fixed all of them. The finding is about delivery, not about whether a fix exists.

“ESU includes critical and important security updates only. It does not include new features, customer-requested non-security updates, or design change requests. ESU does not include technical support for Windows 10, except for assistance with ESU license activation and installation of ESU updates. No other technical support is available.”

“The ESU program helps reduce the risk of malware and cybersecurity attacks by providing access to critical and important security updates as defined by the Microsoft Security Response Center (MSRC) for devices running Windows 10, version 22H2. ESU enrollment does not provide other types of fixes, feature improvements, or product enhancements. It also does not come with technical support.”

The UK and the EEA: what actually differs

The study set out to test whether a UK household pays for updates an EEA household gets free. As published by Microsoft on 20 September 2026, that is not what the difference is. Both regions have a route into consumer ESU that costs no money. What differs is the condition attached to it.

In the United Kingdom there are three routes: no additional cost if you sync your PC settings to Microsoft's cloud; 1,000 Microsoft Rewards points; or a one-off payment Microsoft prices as 30 US dollars or the local currency equivalent plus tax.

In the EEA there are two: no additional cost if you sign in with a Microsoft account and stay signed in, with no settings sync and no Rewards requirement; or the same one-off payment if you would rather keep a local account. The EEA free route also lapses - stop signing in and updates stop within up to 60 days, and you have to enrol again.

So the defensible statement is about the price in data and conditions, not the price in money: a UK household reaches the free route by syncing its PC settings to Microsoft's cloud or by spending Rewards points, where an EEA household only has to stay signed in. Microsoft does not name the destination of that sync on the UK page, and none is asserted here. On the updates themselves Microsoft states that they are 'applied consistently across all supported areas' - a sentence it carries on its US page but not, in this snapshot, on its UK or Irish ones.

Microsoft publishes no sterling figure. The UK page gives only '$30 USD or local currency equivalent plus applicable tax', so no pound figure is published here. One consumer licence covers up to ten devices, which matters to any per-household cost framing.

“You can enroll in ESU in one of the following three ways: At no additional cost if you are syncing your PC Settings. Redeem 1,000 Microsoft Rewards points. One-time purchase of $30 USD or local currency equivalent plus applicable tax.”

“Consumers in the European Economic Area can enroll in ESU through one of the following ways after signing in with a Microsoft account: Users who stay signed in to the eligible PC with a Microsoft account [...] will enable Extended Security Updates on the device through 12 October, 2027, as long as you continue signing in to Windows with your Microsoft account used to enrol.”

Microsoft's own list of countries subject to the EEA terms has 36 entries. It includes Switzerland, which is in EFTA but not the EEA, and five French overseas territories. The United Kingdom is not on it. That endnote is the cleanest sourced basis for saying the UK sits outside the EEA terms.

• The brief for this study assumed the UK route costs money and the EEA route does not. Microsoft's published pages do not support that, and the claim is not made.
• The Euroconsumers letter cited here mis-cites the Digital Markets Act as Regulation (EU) 2022/2065, which is the Digital Services Act. The DMA is Regulation (EU) 2022/1925. The error is flagged so this study does not repeat it, and its companion citation, Directive (EU) 2019/770, is correct.
• A device-count figure in the same letter is sourced to a commercial reseller's blog rather than to any measurement, and its sentence is garbled in the original. It is not used.
• Individuals named in that letter are deliberately not carried into this study or its dataset.

What a non-ESU PC still gets, and what it does not

A Windows 10 22H2 machine without ESU is not cut off from everything. Microsoft Defender Antivirus security intelligence updates continue through October 2028. Microsoft Edge and the WebView2 Runtime keep updating on 22H2 until at least October 2028 and do not require ESU. Microsoft 365 Apps keep receiving security updates to 10 October 2028, though feature updates stop, and the OneDrive desktop app keeps updating on 22H2 to the same date.

Microsoft itself makes the point that antivirus definitions are not a substitute for operating system fixes. What stops without ESU is technical support, feature updates and quality updates including security and reliability fixes - which is exactly the 1486 fixes counted here.

“Devices running Windows 10 will be more vulnerable, even with ongoing security intelligence updates (SIUs).”

“Windows 10 PCs will continue to function. However, Microsoft no longer provides the following for Windows 10 devices: Technical support; Feature updates or new features; Quality updates (including security and reliability fixes).”

The dates, and what changes next

Consumer ESU was extended by a year in June 2026 and now runs to 12 October 2027. The extension was announced as an editor's note appended to a blog post from June 2025 rather than as a standalone announcement, which is why older write-ups still give 13 October 2026.

Commercial ESU runs in three purchasable years: Year 1 ends 13 October 2026, Year 2 ends 12 October 2027, Year 3 ends 10 October 2028. It is cumulative - buying Year 2 means paying for Year 1 as well.

So nothing counted here expires in the weeks after publication. The next date that changes the picture for a household is 12 October 2027, when consumer ESU ends and these monthly fixes stop reaching consumer machines entirely. For a business the next date is 13 October 2026, the end of commercial Year 1.

One thing the count does not mean: that these fixes are gone for good. Microsoft's UK consumer page states that a device can be enrolled at any time up to 12 October 2027, and Microsoft states that Windows quality updates are cumulative, each one built on the updates before it. So the figure here is what a machine has not received to date, not a permanent hole in it. What this study does not test is whether any particular enrolment delivers any particular earlier fix - that would need the update itself, which is not measured here.

Scroll the table sideways to see every column →

Microsoft’s lifecycle tables are timestamped in a United States time zone, so some of these dates read a day later in the source row. Where that happens the row is quoted in the dataset README rather than a bare date being asserted. Planning an estate around these dates: the Windows 10 end-of-life calculator splits a fleet into what can move and what has to be carried.

Other Windows versions, and a footnote on Windows 11

1478 of the 1486 fixes also apply to Windows 11, which is 99.5 per cent of them. Only 8 are Windows 10 only - too few to express as a share. A Windows 11 machine on a version still in support received these same fixes as part of its ordinary monthly update. Windows 11 versions that are themselves out of support did not, and this study does not test which version any machine was on.

The traffic runs the other way too. In the same window Microsoft published 263 CVEs affecting Windows 11 whose records do not name Windows 10 22H2 at all, out of 1,745 affecting Windows 11 in total. That is absence from Microsoft's affected list, not a statement that Windows 10 is unaffected. They are not counted as fixes a Windows 10 machine missed, because Microsoft does not name it as affected.

1485 of the 1486 also name Windows 10 Version 21H2 (build 19044, which is also Enterprise and IoT LTSC 2021). Those products are not in this study's population, and for good reason in both directions: Home and Pro 21H2 went out of support on 14 June 2023 and cannot enrol in ESU at all, because ESU requires 22H2; Enterprise LTSC 2021 is still supported into January 2027 and IoT Enterprise LTSC 2021 into January 2032, so those machines are getting the fixes free.

Scroll the table sideways to see every column →

An earlier draft of this study's brief excluded 21H2 on the grounds that it is 'supported free to 12 January 2027'. That is wrong. 21H2 is excluded because it is out of support entirely and cannot enrol in ESU. The 12 January 2027 date belongs to Enterprise LTSC 2021, which is excluded for the opposite reason. Absence of a product from a CVE record’s affected array is absence from Microsoft’s own affected list, not a claim that the product is unaffected. Nothing here says Windows 10 does not have a flaw; it says Microsoft does not name it.

How the count was made, and how to check it

Sources: CVE Program, CVE List V5 daily bulk release (CVE Program Terms of Use (SPDX: cve-tou)) · CISA Known Exploited Vulnerabilities catalog (CC0 1.0 Universal) · Microsoft Security Update Guide, CVRF v3.0 monthly documents (No open licence. Microsoft site terms.) · Microsoft Learn and microsoft.com - Extended Security Updates, lifecycle and end-of-support pages (Microsoft documentation and website terms) · Euroconsumers, letter to Microsoft Ireland Operations Ltd, 22 September 2025 (No open licence stated). Snapshot hashes: CVE Program bulk release cve_2026-09-20_0300Z, published 2026-09-20T03:28:48Z, sha256 3f226d290571eee431b48efd26cf5e7efbd5a1dc11c224e835e8c087edaadbc0; CISA KEV catalogVersion 2026.09.18, released 2026-09-18T19:00:05Z, 1,716 entries, sha256 7b770a6f5eb1d47a7176ef2f1428594551399912c8f3b5d2bf0f562b7e745e06. Quoted and attributed, not redistributed: aggregate counts only. No per-CVE row from this source is reproduced. The per-month lists of divergent CVE identifiers are derived by diffing Microsoft's list against this study's, and are identifiers, not Microsoft's rows. Fully redistributable. Does not authorise use of the CISA logo or DHS seal and is not an endorsement. CISA and Euroconsumers are named only to identify the organisations whose published material is cited. No Microsoft logo or device mark is used or licensed here, and the illustration on this page is Servnet’s own. Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. Downloads: CSV, 1,486 rows · README and attribution · CVE Program licence, to keep with any copy · JSON. Built by scripts/research/windows-10-missed-security-fixes-2026/analyse.py; 21 automated assertions run, 0 failed.

Questions

Working out what to do about it

Related studies: what UK public bodies’ own FOI answers say about Windows end of support · which servers are certified for Windows Server 2025 and ESXi 9 · seven years of UK data breach reports to the ICO · more Servnet research.