CVE-2025-26636: Microsoft Windows 11 Version 24H2 · Processor Optimization Removal or Modification of Security-critical Code
Affects Microsoft Windows 11 Version 24H2Source CVE Database V5
Not known to be exploited · CVSS 5.5 Medium.
Data as of 25 Oct 2026, 19:02 UTC
- EPSS
- 0.4% chance of exploitation in 30 days – higher than 41% of CVEsExploit Prediction Scoring System: the likelihood attackers will use this flaw soon.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:CExploitation evidence
Disclosed: evidence found.
CVE published 8 Jul 2025
Detectable: no evidence on record.
No public nuclei template indexed
Weaponised: no evidence on record.
No public exploit code indexed in Metasploit or Exploit-DB
Exploited in the wildExploited: no evidence on record.
Not in CISA KEV and no source reports exploitation
Observed by OffSeq MirageSeen by Mirage: no evidence on record.
No attack traffic recorded by OffSeq Mirage sensors
A missing step is not evidence of safety. Sources: cve.org (opens in a new tab), the Metasploit, Exploit-DB and nuclei-templates index as of 2026-10-25.
What to do
Affected software
| Product | Affected | Fixed in |
|---|---|---|
| Microsoft Windows 11 Version 24H2 | Affected
| Fixed in– |
AI-suggested
1. Monitor Microsoft security advisories closely and apply patches or updates as soon as they become available to address CVE-2025-26636. 2. Limit local administrative and privileged access strictly to trusted personnel to reduce the risk of exploitation by insiders or compromised accounts. 3. Employ endpoint detection and response (EDR) solutions to monitor for unusual local activity that could indicate attempts to exploit kernel vulnerabilities. 4. Use application whitelisting and privilege management to restrict execution of unauthorized code or escalation attempts. 5. Conduct regular audits of user accounts and permissions to ensure minimal necessary privileges are assigned. 6. For highly sensitive environments, consider additional isolation or virtualization techniques to limit the impact of local exploits. 7. Educate users and administrators about the risks of local privilege misuse and the importance of timely patching. 8. Implement strict physical security controls to prevent unauthorized local access to critical systems. These steps go beyond generic advice by focusing on controlling local access vectors and preparing for patch deployment.
Description
Processor optimization removal or modification of security-critical code in Windows Kernel allows an authorized attacker to disclose information locally.