Windows 11 26H2

A newly catalogued vulnerability, EUVD-2026-99171, carries a CVSS v3.1 score of 7.0 and affects Windows 11 versions 26H1 and 26H2, Windows Server 2025 and other Microsoft products. The flaw is a use-after-free bug in the Windows Search Component that allows an authorized attacker to elevate privileges. The advisory was updated on 13 October 2026.

Microsoft's October Windows update fixes around 1,400 security vulnerabilities, including two zero-day flaws already being exploited. The release is also the first official patch for Windows 11 26H2 and coincides with the end of support for Windows 11 24H2 Home and Pro editions. It is being described as an unusually large monthly security rollout for the company.

Microsoft has officially announced the end of life for Windows 11 version 24H2 for Home and Pro editions, meaning these versions will no longer receive security updates. Users are being urged to upgrade to version 25H2 or 26H2 to keep receiving critical security patches. Commenters in cybersecurity circles are warning that staying on 24H2 leaves machines exposed to unpatched vulnerabilities.

A new vulnerability, EUVD-2026-100400, has been catalogued affecting multiple Windows versions, including Windows 11 24H2 and 26H2 and Windows 10 21H2. The flaw, rated 7.8 out of 10 on the CVSS v3.1 scale, involves improper neutralization of argument delimiters in a command, known as argument injection. Security teams are assessing exposure and patching status.

Microsoft's Intune team has confirmed that the new Windows 11 26H2 security baseline will not automatically update existing baseline profiles in tenant environments. IT administrators who want to adopt the 26H2 settings will need to manually revise or recreate their deployed baseline profiles. The news matters for enterprise device management teams planning security compliance updates across their Windows fleets.