Windows 10, one year on: the security fixes a non-ESU PC did not receive Published dataset: windows-10-missed-security-fixes-2026.csv Copyright © 1999-2026, The MITRE Corporation. CVE is a trademark and the CVE logo is a registered trademark of The MITRE Corporation. The CVE Program Terms of Use grant a perpetual, worldwide, royalty-free, irrevocable licence to reproduce, prepare derivative works of, display and distribute CVE data, including commercially, on the condition that MITRE's copyright designation above AND the licence itself are reproduced with any copy. Both are reproduced below. Keep the designation line with the CSV, and keep this README - or windows-10-missed-security-fixes-2026-LICENCE-CVE-PROGRAM.txt, published beside the CSV - with it. ================================================================================================== LICENCE: CVE PROGRAM TERMS OF USE (SPDX: cve-tou) ================================================================================================== Reproduced in full, as the licence requires. It governs every CVE-derived column in the CSV: cve_id, date_public, patch_month, title, description, component, cvss_v3_1_*, cwe_ids, the w10_22h2_* build and platform columns, also_affects_*, affected_product_count, cisa_adp_ssvc_exploitation, msrc_url, cve_record_sha256 and cve_record_date_updated. The in_cisa_kev, kev_date_added, kev_days_publication_to_listing, kev_known_ransomware_campaign_use and kev_vulnerability_name columns are CC0 1.0 from CISA. component_family and vuln_type are Servnet's classification and are CC BY 4.0. Source of this text: https://raw.githubusercontent.com/spdx/license-list-data/main/json/details/cve-tou.json Terms of Use: https://www.cve.org/Legal/TermsOfUse CVE Usage: MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE(R)). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN "AS IS" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE. ================================================================================================== AS AT ================================================================================================== All figures are as at 20 September 2026, computed from a frozen snapshot of the CVE Program bulk release cve_2026-09-20_0300Z and the CISA Known Exploited Vulnerabilities catalogue v2026.09.18. Both sources are revised continuously: CVE records are amended after publication, and CISA adds KEV entries retroactively. Re-running this filter against a later release will produce larger numbers. That is a property of the sources, not a correction to this dataset. ================================================================================================== WHAT THIS IS ================================================================================================== Support for Windows 10 Home and Pro, and for version 22H2, ended on 14 October 2025. From 15 October 2025 the monthly Windows security update for 22H2 reached only machines enrolled in Extended Security Updates. This dataset is one row per Microsoft security fix that a Windows 10 Home or Pro 22H2 PC without ESU therefore did not receive, between 15 October 2025 and 20 September 2026. Microsoft shipped a fix for every CVE in this file. Every one of them carries a shipped Windows 10 22H2 update in Microsoft's own Security Update Guide. This dataset is about which machines received the fix. It does not say Windows 10 was left without a patch, and the word 'unpatched' does not describe it. Rows: 1486 Unit: one CVE Window: 2025-10-15 to 2026-09-20 Of those, in the CISA KEV catalogue: 12 ================================================================================================== FILE FORMAT ================================================================================================== UTF-8, comma separated, one physical line per record. The first three lines begin with '#' and carry MITRE's copyright designation, the provenance line and a pointer to the CVE Program licence text; the fourth line is the header row. Read with comment='#' or skip the first three lines. Whitespace inside descriptions has been collapsed to single spaces so that every record is one line. ================================================================================================== COLUMNS ================================================================================================== cve_id CVE identifier. date_public Date Microsoft made the CVE record public (CVE v5 containers.cna.datePublic), ISO date. patch_month Calendar month of date_public, YYYY-MM. title Microsoft's own title for the vulnerability, as carried in the CVE record. description Microsoft's own description, whitespace collapsed to a single line. component Windows component as Microsoft names it in the CVE title. component_family Component family assigned by the published rule list in stage2_filter.py. vuln_type Vulnerability class parsed from Microsoft's title (Elevation of Privilege, Remote Code Execution, and so on). cvss_v3_1_base_score CVSS v3.1 base score as scored by the MICROSOFT CNA inside the CVE record. Not NVD's score. cvss_v3_1_base_severity CVSS v3.1 base severity from the same Microsoft CNA metric. cvss_v3_1_vector CVSS v3.1 vector string from the same Microsoft CNA metric. cwe_ids CWE identifiers from the CVE record, semicolon separated. w10_22h2_first_affected_build First affected Windows 10 22H2 build, from the CVE record's affected[] entry. w10_22h2_first_fixed_build First FIXED Windows 10 22H2 build (the affected[] lessThan value). This is the build that carried the fix, and it is the build a non-ESU PC never reached. w10_22h2_platforms 22H2 platforms Microsoft names as affected, semicolon separated. also_affects_w10_21h2_or_ltsc2021 true where the same CVE also names Windows 10 Version 21H2 (build 19044, which is also Enterprise and IoT LTSC 2021). Flag only; those products are outside this study's population. also_affects_windows_11 true where the same CVE also names a Windows 11 product. also_affects_windows_server true where the same CVE also names a Windows Server product. affected_product_count Number of entries in the CVE record's affected[] array, all products, not just Windows 10. cisa_adp_ssvc_exploitation CISA-ADP SSVC Exploitation value carried inside the CVE record: active, poc or none. in_cisa_kev true where the CVE is in the CISA Known Exploited Vulnerabilities catalogue at the snapshot date. kev_date_added Date CISA added the CVE to KEV, blank where not listed. kev_days_publication_to_listing Whole days from date_public to kev_date_added. Date-only arithmetic; it cannot resolve hours. Blank where not listed. kev_known_ransomware_campaign_use CISA's ransomware flag: Known or Unknown. 'Unknown' means not established, not 'not used'. Blank where not listed. kev_vulnerability_name CISA's own name for the vulnerability, blank where not listed. msrc_url Microsoft Security Update Guide page for the CVE, so a reader can check Microsoft's own severity rating and the KB that carried the fix. A link, not reproduced data. cve_record_sha256 SHA-256 of the CVE v5 JSON record as it stood in the frozen bulk release, so any figure here can be traced to a byte-identical source record. cve_record_date_updated dateUpdated from the CVE record. CVE records are revised continuously; this is the revision this snapshot saw. ================================================================================================== METHOD ================================================================================================== Unit of analysis: One CVE. Population: Every CVE published by the Microsoft CNA between 15 October 2025 and 20 September 2026 whose CVE Program v5 record names "Windows 10 Version 22H2" as a vulnerable component, excluding those the free update of 14 October 2025 had already fixed. Inclusion test: cveMetadata.assignerShortName == 'microsoft' AND cveMetadata.state == 'PUBLISHED' AND containers.cna.datePublic >= 2025-10-15 AND containers.cna.affected[] contains an entry with product == 'Windows 10 Version 22H2' (exact string, case-insensitive) carrying a versions[] item with status 'affected'. Exclusion rules, with the number of CVEs each removed: E1 - named but not affected - removed 0 22H2 named in affected[] but no versions[] item with status 'affected' E2 - wrong build family - removed 0 22H2 first-fixed build outside the 10.0.19045.* family, i.e. a data artefact E3 - already fixed before support ended - removed 4 first fixed at or below build 10.0.19045.6456, the free 14 October 2025 update, so a non-ESU PC did receive the fix CVEs removed: CVE-2025-62208, CVE-2025-62209, CVE-2025-64679, CVE-2025-64680 This rule was not in the study brief and is necessary. Any recount that skips it lands on 1,490 rather than 1,486. E4 - serviced outside ESU - removed 0 component delivered outside the Windows monthly cumulative update AND first fixed at a build other than that Patch Tuesday's Yield zero, and the zero is the finding. Ten candidates exist - SQL Server ODBC driver, Windows WebView, Defender Firewall Service, some Office-named entries, WDAC OLE DB, Device Health Attestation. Every one carries the same Windows 10 22H2 first-fixed build as the rest of its Patch Tuesday, so all ten ship in the Windows monthly cumulative update, which is exactly what ESU delivers. Excluding them on component name alone would have silently dropped ten in-scope fixes. Microsoft Defender Antivirus proper, Edge and WebView2 never name Windows 10 Version 22H2 at all and so never entered the set. E5 - running-on artefact - removed 0 every windows_10_22H2 cpeMatch marked vulnerable:false, i.e. 22H2 is only the host platform Yield zero. All 3,101 in-window records carry cpeApplicability and every 22H2 cpeMatch across the matched set is vulnerable:true. Running-on artefacts do exist elsewhere in the data, such as Internet Explorer 11 on Windows 10 Version 1903, which is why a substring match on '22H2' would be wrong: it would also pull in 'Windows 11 version 22H2'. CVE v5 schema semantics: Across all 33,881 affected[] entries in the 3,101 in-window Microsoft records, the only version status Microsoft uses is 'affected' and defaultStatus is never set. Presence of the exact product string in containers.cna.affected is therefore itself the vulnerable-component claim. Every Windows 10 Version 22H2 entry - all 1,490 of them - uses versionType 'custom', with version = the first affected build and lessThan = the first fixed build. 231 of the 33,881 entries carry no versionType at all: they are cloud-service products such as Microsoft Entra and Azure Key Vault, written as version '-' with no lessThan. None of them is a Windows 10 entry, so a recount is unaffected, but a recounter who assumes versionType is always present will hit them. The 14 October 2025 boundary: The boundary build 10.0.19045.6456 is derived inside the CVE data, not taken from an outside claim: 91 Microsoft-CNA CVEs dated 14 October 2025 give that value as the Windows 10 22H2 lessThan. September 2025 gives 6332 and July 2025 gives 6093, confirming the progression. Exploitation overlay: Exact match on CVE identifier between the published dataset and the cveID field of the CISA KEV catalogue. Lag is KEV dateAdded minus CVE datePublic in whole days; it is date-only arithmetic and cannot resolve hours. The join was cross-checked against the CISA-ADP SSVC Exploitation field carried inside the CVE records, and against a hand check of every entry against the raw catalogue. Classification: Component family and vulnerability type are parsed from Microsoft's own CVE titles by an ordered rule list published in stage2_filter.py. Cross-check: Monthly totals were recounted against Microsoft's own Security Update Guide, by three independent routes within that source: matching on product id, matching on product name string, and counting CVEs carrying a 22H2 vendor-fix KB. All three agree for every month. Percentages: Every percentage states its denominator. No percentage is published on a count below 10; those cuts say so. Percentages are rounded to one decimal place and may not sum to 100. Revisions: Both primary sources are revised continuously. This study freezes and hashes them at 2026-09-20 and carries that date on every figure. Reproducibility: The analysis script performs no network access. It reads the frozen local snapshot only, so it produces identical output on every run. ================================================================================================== HEADLINE FIGURES, WITH DENOMINATORS ================================================================================================== Microsoft security fixes a Windows 10 Home or Pro 22H2 PC without ESU did not receive: 1486 denominator: 3101 (Microsoft-CNA CVE records in PUBLISHED state with datePublic on or after 15 October 2025, in the frozen bulk release) share of denominator: 47.9 per cent floor: The CVE Program v5 population counts Microsoft-CNA records only. Microsoft's own Security Update Guide lists 1500 for the same months because it also relays fixes whose CVE records belong to other CNAs. Both figures are published below. recompute: From the published CSV: count the rows. From source: filter the CVE Program v5 bulk release to assignerShortName == 'microsoft', state == 'PUBLISHED' and containers.cna.datePublic >= 2025-10-15, keep records whose containers.cna.affected[] contains an entry with product == 'Windows 10 Version 22H2' carrying a versions[] item with status 'affected', then drop records whose lessThan build is <= 10.0.19045.6456. of those fixes, flaws CISA lists in its Known Exploited Vulnerabilities catalogue: 12 denominator: 1486 (all fixes a non-ESU 22H2 PC did not receive in the window) share of denominator: 0.8 per cent floor: KEV lists only what CISA has confirmed and chosen to publish, it is US-centric, and listings are retroactive - one entry here was added 126 days after publication. K will rise after this snapshot. Read it as 'at least 12'. recompute: Join the published CSV's cve_id to the cveID field of the CISA KEV catalogue and count matches. The CSV's in_cisa_kev column is that join, frozen at the snapshot date. of those KEV entries, ones CISA listed on the same day the fix shipped: 9 denominator: 12 (KEV entries in the population) denominator is 12, fewer than 10; no percentage is published recompute: Count rows in the published CSV where kev_days_publication_to_listing = 0. median fixes missed per month: 70 denominator: 11 (months with at least one publication date in the window) recompute: Group the published CSV by patch_month, count rows, take the median. Microsoft's own count of CVEs affecting Windows 10 Version 22H2 for the same months: 1500 denominator: 1500 (self) recompute: Read the eleven monthly CVRF documents from November 2025 to September 2026 and count distinct CVEs whose ProductStatuses 'Known Affected' list names a Windows 10 Version 22H2 product id. This figure is a citation: the underlying rows carry no open licence and are not in the published dataset. Monthly counts (month, fixes missed, cumulative): 2025-11 32 32 2025-12 29 61 2026-01 70 131 2026-02 24 155 2026-03 43 198 2026-04 105 303 2026-05 53 356 2026-06 91 447 2026-07 313 760 2026-08 158 918 2026-09 568 1486 Median 70 a month, range 24 to 568. No monthly rate is published: Monthly values run from 24 to 568, a factor of 23.7. A single 'growing by N a month' figure would misdescribe the series, so the median and the full range are published instead and no rate is claimed. The window is about eleven and a quarter months, but October 2025 contributes nothing - its Patch Tuesday fell on the 14th, the last day of free support - so the median, mean and range are computed over the eleven months that carry a Patch Tuesday inside the window. ================================================================================================== WHERE SOURCES DISAGREE ================================================================================================== How many fixes were missed? CVE Program v5, Microsoft-CNA records only: 1486 Microsoft Security Update Guide (CVRF v3.0), cited not reproduced: 1500 All 14 of them are individually accounted for and none is a filter error. 10 are not Microsoft-CNA records at all: their CVE records are assigned by CERT/CC (3), MITRE (3), GitHub (2), AMD (1) and Arm (1), and Microsoft relays them because a Microsoft update carries the fix. The other four were already fixed by the free 14 October 2025 update. The CVE Program set is a strict subset of Microsoft's: nothing is in this study's population and absent from Microsoft's list. All fourteen are named below, in the dataset README and in this study's JSON. Does the study's own pre-publication divergence gate pass? Gate as written: any month diverging by more than 2 per cent against Microsoft blocks publication: trips on 4 months: 2025-11, 2025-12, 2026-01, 2026-06 The same months in absolute counts: 4, 2, 2 and 2 CVEs This gate was set before the data was pulled, as a condition that would block publication. It tripped on four months. On months of 24 to 36 CVEs a single record is worth 3 to 4 per cent, so the percentage gate is tripped by arithmetic on small denominators, not by a defect: the absolute differences are 4, 2, 2 and 2 CVEs. Every divergent CVE is named in the table below, in the dataset README and in this study's JSON, and all fourteen are accounted for. Publication proceeded on that basis. The gate is reported as tripped and the reason published, rather than the gate being quietly restated. Month by month against Microsoft's Security Update Guide, with every divergent CVE named: 2025-11 Microsoft 36 this study 32 difference 4 (11.11% of that month's Microsoft count; over the 2% gate: yes) divergent: CVE-2025-62208, CVE-2025-62209, CVE-2025-64720, CVE-2025-65018 2025-12 Microsoft 31 this study 29 difference 2 (6.45% of that month's Microsoft count; over the 2% gate: yes) divergent: CVE-2025-64679, CVE-2025-64680 2026-01 Microsoft 72 this study 70 difference 2 (2.78% of that month's Microsoft count; over the 2% gate: yes) divergent: CVE-2023-31096, CVE-2024-55414 2026-02 Microsoft 24 this study 24 difference 0 (0.0% of that month's Microsoft count; over the 2% gate: no) 2026-03 Microsoft 43 this study 43 difference 0 (0.0% of that month's Microsoft count; over the 2% gate: no) 2026-04 Microsoft 106 this study 105 difference 1 (0.94% of that month's Microsoft count; over the 2% gate: no) divergent: CVE-2026-25250 2026-05 Microsoft 54 this study 53 difference 1 (1.85% of that month's Microsoft count; over the 2% gate: no) divergent: CVE-2025-54518 2026-06 Microsoft 93 this study 91 difference 2 (2.15% of that month's Microsoft count; over the 2% gate: yes) divergent: CVE-2025-10263, CVE-2026-8863 2026-07 Microsoft 313 this study 313 difference 0 (0.0% of that month's Microsoft count; over the 2% gate: no) 2026-08 Microsoft 160 this study 158 difference 2 (1.25% of that month's Microsoft count; over the 2% gate: no) divergent: CVE-2026-6726, CVE-2026-6727 2026-09 Microsoft 568 this study 568 difference 0 (0.0% of that month's Microsoft count; over the 2% gate: no) Of the fourteen, four were removed by exclusion rule E3 because the free 14 October 2025 update had already fixed them, and the rest are CVE records the Microsoft CNA does not own, which Microsoft relays because a Microsoft update carries the fix. Their assigners, read from the frozen bulk release: CVE-2023-31096 = mitre; CVE-2024-55414 = mitre; CVE-2025-10263 = Arm; CVE-2025-54518 = AMD; CVE-2025-64720 = GitHub_M; CVE-2025-65018 = GitHub_M; CVE-2026-25250 = mitre; CVE-2026-6726 = certcc; CVE-2026-6727 = certcc; CVE-2026-8863 = certcc. How many of these flaws were being exploited? CISA Known Exploited Vulnerabilities catalogue, v2026.09.18: 12 Microsoft's own 'Exploited: Yes' flag in the Security Update Guide, cited not reproduced: 11 These are different measures and neither is a superset by definition. Here they overlap on 11 CVEs. CISA lists 1 that Microsoft did not flag at publication (CVE-2026-33824), which CISA added 126 days later; Microsoft flags 0 that CISA has not listed (none). Does the study's own pre-registered headline survive the data? Study brief, pre-registered floor: 1204 Study brief, alternative estimate using Microsoft's own affected lists: about 1,500 This analysis, CVE Program v5: 1486 This analysis, Microsoft's own count, cited: 1500 The pre-registered floor of 1,204 does not survive. 8 of the 11 months match it within one CVE; November 2025 and December 2025 are two out; and September 2026 is 285 out, where the brief expected 283 and the CVE records give 568. The brief's own alternative estimate, about 1,500 from Microsoft's affected lists, is what the data supports. The published figure is 1,486. Every month is set out against the brief below. This is recorded rather than quietly corrected, because the brief was written before the data was pulled and the filter is published so anyone can recount. Month by month against the study brief's pre-registered floor: 2025-11 brief 34 this study 32 difference -2 2025-12 brief 31 this study 29 difference -2 2026-01 brief 70 this study 70 difference +0 2026-02 brief 24 this study 24 difference +0 2026-03 brief 42 this study 43 difference +1 2026-04 brief 104 this study 105 difference +1 2026-05 brief 53 this study 53 difference +0 2026-06 brief 91 this study 91 difference +0 2026-07 brief 313 this study 313 difference +0 2026-08 brief 159 this study 158 difference -1 2026-09 brief 283 this study 568 difference +285 Does ESU deliver every one of these fixes? Microsoft's ESU documentation: Critical and Important security updates only, of four MSRC severity levels Microsoft's Security Update Guide for these months: 2 of 1500 are rated Moderate, and all 1500 carry a shipped 22H2 fix in the monthly cumulative update The documentation bounds ESU by severity; the update mechanics do not obviously allow a Moderate-rated fix to be stripped out of a cumulative update that also carries Critical and Important ones. Nothing Microsoft publishes settles it either way, so both are stated and no claim is made that ESU subscribers miss anything. ================================================================================================== CAVEATS ================================================================================================== - As at 20 September 2026. CVE records are revised continuously, so counts for past months rise over time. Everything here is computed from a frozen, hashed snapshot of the CVE Program's bulk release of 20 September 2026 and the CISA KEV catalogue v2026.09.18. Re-running the same filter on a later release will give a larger number, which is a property of the source, not a correction to this one. - Microsoft's own monthly documents are living documents too. All twelve carry a current release date in September 2026 while their version field still reads 1.0 - the October 2025 document was last revised on 19 September 2026. - 1,486 is a floor. It counts Microsoft-CNA records only; Microsoft's own list for the same months is 1,500, and the difference is fully explained but not folded in. - 12 is a floor. The CISA KEV catalogue lists only what CISA has confirmed and chosen to publish, it is US-centric, and listings are retroactive. - Absence of a product from a CVE record's affected array is absence, not a claim that the product is unaffected. This matters for any reasoning about what Windows 10 does not have. - Monthly counts swing from 24 to 568, so no monthly rate is published. The median and the full range are published instead, computed over the eleven months that carry a Patch Tuesday inside the window; October 2025 contributes nothing, because its Patch Tuesday fell on the 14th, the last day of free support. - September 2026 is a part month: it covers the 8 September Patch Tuesday, not the whole calendar month, and October's Patch Tuesday falls after the snapshot. - The severity figures come from two different scales. CVSS v3.1 in the dataset is the Microsoft CNA's own score inside the CVE record, not NVD's. Microsoft's Critical/Important rating is a separate scale and is cited from the Security Update Guide, not reproduced. - NVD was not used. The National Vulnerability Database's 'configurations' data lags and undercounts affected products - applying it to September 2026 would have halved that month. No NVD API key was registered and no NVD data is in this study. - Component families are assigned by a rule list parsed from Microsoft's own CVE titles. The rule list is published in the analysis scripts so the classification can be disputed. Some assignments are defensible but arguable. - Microsoft spells some component names several ways across months, and seven CVE titles in this set contain Microsoft's typo 'Vulernability'. Both are handled, and the raw component string is kept in the dataset alongside the merged family. - This study can say which build first carried each fix, because Microsoft states it in the CVE record. It does not map builds to KB numbers or release dates: that would need the Security Update Guide, which is cited here rather than reproduced. - Nothing here says Windows 10 was left without a patch. Microsoft shipped a fix for every CVE counted. The measurement is about which machines received it. - This is a count of what a machine has not received to date, not a permanent gap. Microsoft's UK consumer page states that a device can be enrolled in consumer ESU at any time until the programme ends on 12 October 2027, and Microsoft states that Windows quality updates are cumulative. Whether any particular enrolment delivers any particular earlier fix is not tested here. - This is a count of fixes, not a measure of risk to any individual machine. Most of these flaws require code already running on the device. No claim is made that any particular PC was attacked. - No personal data is present. The dataset contains CVE identifiers, Microsoft product and component strings, builds, dates and scores. Researcher acknowledgements in Microsoft's source documents were never read into any output, and individuals named in a cited consumer-group letter are not carried into the dataset or the page. ================================================================================================== SOURCES AND LICENCES ================================================================================================== CVE Program, CVE List V5 daily bulk release role: primary - the affected-product claim comes from Microsoft's own CNA record, with no enrichment lag url: https://github.com/CVEProject/cvelistV5 release: cve_2026-09-20_0300Z, published 2026-09-20T03:28:48Z retrieved: 2026-09-20T04:18Z sha256: 3f226d290571eee431b48efd26cf5e7efbd5a1dc11c224e835e8c087edaadbc0 licence: CVE Program Terms of Use (SPDX: cve-tou) redistributable: yes Perpetual, worldwide, royalty-free, irrevocable licence to reproduce, prepare derivative works of, display and distribute, including commercial use, conditional on reproducing MITRE's copyright designation AND this licence in any copy. Both ship with the download: the designation on the CSV's first line, the licence text in the README and in windows-10-missed- security-fixes-2026-LICENCE-CVE-PROGRAM.txt beside the CSV. CISA Known Exploited Vulnerabilities catalog role: exploitation overlay url: https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json release: catalogVersion 2026.09.18, released 2026-09-18T19:00:05Z, 1,716 entries retrieved: 2026-09-20T04:18:41Z sha256: 7b770a6f5eb1d47a7176ef2f1428594551399912c8f3b5d2bf0f562b7e745e06 licence: CC0 1.0 Universal redistributable: yes Fully redistributable. Does not authorise use of the CISA logo or DHS seal and is not an endorsement. Microsoft Security Update Guide, CVRF v3.0 monthly documents role: cross-check only - monthly totals, Microsoft's own severity rating, and confirmation that every fix shipped url: https://api.msrc.microsoft.com/cvrf/v3.0/cvrf/2026-Sep release: twelve monthly documents, October 2025 to September 2026 retrieved: 2026-09-20, requests spaced 35 seconds apart with an identifying user agent licence: No open licence. Microsoft site terms. redistributable: no Quoted and attributed, not redistributed: aggregate counts only. No per-CVE row from this source is reproduced. The per-month lists of divergent CVE identifiers are derived by diffing Microsoft's list against this study's, and are identifiers, not Microsoft's rows. Microsoft Learn and microsoft.com - Extended Security Updates, lifecycle and end-of-support pages role: ESU scope, eligibility, dates, enrolment routes and the UK/EEA difference url: https://learn.microsoft.com/en-us/windows/whats-new/extended-security-updates retrieved: 2026-09-20 licence: Microsoft documentation and website terms redistributable: no Short attributed quotation only. Cached pages are kept as evidence and are not published. Euroconsumers, letter to Microsoft Ireland Operations Ltd, 22 September 2025 role: one consumer-group characterisation of the EEA concession, used for context only url: https://www.euroconsumers.org/wp-content/uploads/2025/09/Euroconsumers_vs_Microsoft_092025.pdf retrieved: 2026-09-20 licence: No open licence stated redistributable: no Cite only. Individuals named in the letter are not carried into this study. One legal citation in the letter is wrong and one figure in it is unusable; both are flagged on the page rather than repeated. NVD CVE API 2.0 role: not used url: https://services.nvd.nist.gov/rest/json/cves/2.0 licence: n/a redistributable: no Deliberately not used. NVD's configurations data lags and would have undercounted the most recent month by roughly half. No NVD API key was registered. Only the CVE Program and CISA KEV sources are redistributable, and they are the only sources in this CSV. Microsoft's Security Update Guide, Microsoft's documentation pages and the Euroconsumers letter are cited on the study page and are not reproduced here. ================================================================================================== HOW TO CHECK THIS ================================================================================================== Everything below can be recomputed from the published CSV alone, except the items marked as needing the original sources. The filter is published so a journalist can recount from the CVE Program's own bulk release. - the headline count source: the published CSV method: count data rows, excluding the three leading '#' comment lines and the header expected: 1486 - no duplicate CVE identifiers source: the published CSV method: count distinct cve_id expected: 1486 - monthly counts source: the published CSV method: group by patch_month and count expected: 2025-11=32, 2025-12=29, 2026-01=70, 2026-02=24, 2026-03=43, 2026-04=105, 2026-05=53, 2026-06=91, 2026-07=313, 2026-08=158, 2026-09=568 - monthly median, minimum and maximum source: the published CSV method: median, min and max of the monthly counts expected: [70, 24, 568] - CVEs in the CISA KEV catalogue source: the published CSV method: count rows where in_cisa_kev is true expected: 12 - days from publication to KEV listing source: the published CSV method: sorted values of kev_days_publication_to_listing where in_cisa_kev is true expected: [0, 0, 0, 0, 0, 0, 0, 0, 0, 1, 14, 126] - KEV entries listed on the day the fix shipped source: the published CSV method: count rows where kev_days_publication_to_listing = 0 expected: 9 - no KEV entry carries CISA's 'Known' ransomware flag source: the published CSV method: count rows where kev_known_ransomware_campaign_use = 'Known' expected: 0 - CVSS severity split source: the published CSV method: group by cvss_v3_1_base_severity and count; buckets must sum to the headline expected: CRITICAL=38, HIGH=1102, LOW=3, MEDIUM=343 - component family league table source: the published CSV method: group by component_family and count; must sum to the headline expected: Networking and protocols=286, File systems and storage=251, Authentication and identity=152, Graphics, fonts and imaging=123, Kernel and Win32k=119, Management and servicing=119, Shell and user interface=107, Audio, video and media=69, Devices and drivers=64, Remote Desktop and RDP=64, COM, RPC and scripting=37, Boot and platform security=36, Hyper-V and virtualisation=27, Printing and scanning=26, Office file handling in Windows=3, Third-party silicon mitigations=2, Other Windows component=1 - no row was already fixed by the last free build source: the published CSV method: count rows where w10_22h2_first_fixed_build <= 10.0.19045.6456 expected: 0 - Windows 11 overlap source: the published CSV method: count rows where also_affects_windows_11 is true expected: 1478 - the KEV catalogue join itself source: the original CISA KEV catalogue, CC0, free to download method: download the catalogue, match its cveID values against the CSV's cve_id, count matches. Note that KEV listings are added over time, so a later catalogue will match more. expected: 12 - the population filter from source source: the CVE Program cvelistV5 bulk release method: apply method.inclusionTest and the five exclusion rules. A recount that omits rule E3 will land on 1,490, which is the expected divergence, not a defect. expected: 1486 - each row's source record source: the CVE Program record for any cve_id method: the CSV carries cve_record_sha256 for every row, the SHA-256 of the CVE v5 JSON record as it stood in the frozen bulk release. Later revisions of a record will hash differently; that is revision drift, not an error. expected: byte-identical Known divergences a recount may hit: - a recount that omits exclusion rule E3 will give 1490: four CVEs published in November and December 2025 were already fixed by the free 14 October 2025 update, so a non-ESU PC did receive them - a recount against Microsoft's Security Update Guide will give 1500: Microsoft also relays fixes whose CVE records belong to other CNAs. The CVE Program set is a strict subset; all fourteen differences are named on the page. - a recount using NVD 'configurations' rather than the CVE v5 CNA affected array will give materially lower, roughly half for the most recent month: NVD enrichment lags behind publication. This study does not use NVD. - a recount against a later CVE Program release will give higher: CVE records are revised continuously and past-month counts rise. ================================================================================================== PERSONAL DATA ================================================================================================== None. This dataset contains CVE identifiers, Microsoft product and component strings, build numbers, dates, scores and CISA catalogue fields. Researcher acknowledgements present in Microsoft's source documents were never read into any output. Individuals named in a cited consumer-group letter are not carried into this dataset or the study page. ================================================================================================== ATTRIBUTION ================================================================================================== Analysis and dataset compilation: Servnet, https://www.servnetuk.com/research. Servnet's analysis and derived columns are free to reuse under CC BY 4.0 with attribution to 'Servnet Windows 10 Missed Security Fixes 2026' and a link to the study page: https://www.servnetuk.com/research/windows-10-missed-security-fixes-2026 The CVE-derived columns carry the CVE Program Terms of Use: MITRE's copyright designation AND the licence text above must be reproduced with any copy. The CISA KEV columns are CC0 1.0 and carry no attribution requirement; CISA does not endorse this study and its logo and the DHS seal are not used. CORRECTIONS AND TAKEDOWN: tell us at webmaster@servnetuk.com and we will check it. The policy is at https://www.servnetuk.com/research/corrections. OUR INTEREST: Servnet sells and maintains IT hardware and services, including some of the products this study measures. The study reports what the sources show; it is not a recommendation to buy anything, and no organisation paid for, sponsored or approved it. Built by scripts/research/windows-10-missed-security-fixes-2026/analyse.py on 2026-09-20.