Patch tracker / Products / Windows 11 version 21H2

Windows 11 version 21H2: vulnerabilities and security updates

Every CVE affecting Windows 11 version 21H2 and the Microsoft update (KB) that fixes it, ranked by real-world risk. Actively exploited (CISA KEV) first, then EPSS exploit probability, on top of CVSS severity.

CVEs

Updates (KBs)

Actively exploited (KEV)

Critical Severity

CVEs affecting Windows 11 version 21H2

CVE	Severity	CVSS	EPSS	Status
CVE-2024-38163	High	7.8	0.7%	-

Updates (KBs) for Windows 11 version 21H2

Update	Released	Severity	CVSS	EPSS	CVEs	Status
KB5042320	2024-08-13	High	7.8	0.7%	1	-
KB5042321	2024-08-13	High	7.8	0.7%	1	-
KB5042322	2024-08-13	High	7.8	0.7%	1	-

Ranked across all products on the Microsoft patch tracker and the CVE and vulnerability management reference. Browse every product: product index.

Most searched on Senserva right now

KB5094123: patch details CVE-2008-4250: severity and the patch CVE-2026-48282: severity and the patch CVE-2007-3010: how to fix it CVE-2026-55255: severity and the patch KB5094122: patch details CVE-2012-0151: severity and the patch KB5093998: the full CVE list CVE-2014-1761: severity and the patch CVE-2019-0808 patch and risk

Sponsored by Senserva

This page shows the fix. Siemserva by Senserva shows which of your devices are still missing it: which ones are exposed to Windows 11 version 21H2, for example, ranked by what attackers actually exploit.

Patch status in one scan: which devices are affected, which are not
Missing updates ranked by CISA KEV and EPSS, so you fix the right things first
Data from Intune, Microsoft Defender, Windows Autopatch, and Azure Update Manager, with more sources on the way
Third-party app patching too: updates published to Intune by PatchMyPC, Scappman, Robopack, or any vendor, read vendor-neutrally
Optional AI Enhanced Reporting: plain-language summaries and recommended next steps written into your reports
Then go further: 650+ security checks find the 7 Microsoft 365 misconfigurations behind most SME breaches, with compliance evidence and Senserva Trustworthy AI remediation

Senserva patching for Microsoft 365

Two minutes, click to play

Patching in action in two minutes. Watch page · All videos.

PATCHINGTenant: Contoso Manufacturing ▾OverviewAutopatch healthDevicesAsk SenservaExport Patch Status Report

3 actively exploited CVEs are unmitigated on devices in this tenant, per CISA KEV.View fix-first list ↓

312

Devices scanned

Intune + Autopatch + Defender

Exploited updates missing

CISA KEV, unmitigated

905

Microsoft updates tracked

Refreshed daily, MSRC + NVD

650+

Security checks in scan

Patch, config, identity, logs

Triage order for this list

Same order in the dashboard, the report, and every AI answer

1st · overrides everything

Actively exploited (KEV)

e.g. KB5040219, CVE-2026-31210

→

2nd · tiebreaker

Severity (Critical → Low)

MSRC + EPSS probability

→

3rd · tiebreaker

Days waiting

Oldest unresolved first

Ranked missing updates, fix-first order

27 findings · showing top 2

#	Update	CVE	Severity	Source	Devices	Waiting
1	KB5040219 Windows 11 23H2 cumulative	CVE-2026-31210 KEV EPSS 0.94	Critical	Defender	41	19 days	Add to fix-first
2	KB5040088 .NET Framework security update	CVE-2026-29981 KEV	Critical	Intune	17	12 days	Add to fix-first

Estimated dashboard, sample data for illustration

Ask Senserva

via Claude + MCP

Which devices are still missing the fix for CVE-2026-31210?

41 devices are missing KB5040219, which resolves CVE-2026-31210. This CVE is on CISA KEV, so CISA BOD 22-01 calls for remediation within 14 days. You are at 19 days and counting.

source: scan_db · defender_posture · kev_join, not model memory

Get Devices Found Get Devices Missing

Senserva is a Microsoft Intelligent Security Association member. Get Going with Senserva Senserva patching Built for IT admins and security teams, with audit-ready data for compliance.

Lexicon: the terms on this page

CVE: Common Vulnerabilities and Exposures. A unique ID for one publicly known vulnerability, such as CVE-2025-1234.
KB: Microsoft Knowledge Base article. The identifier for a specific Microsoft update.
KEV: CISA Known Exploited Vulnerabilities. CVEs confirmed exploited in the wild. Fix these first.
CVSS: Common Vulnerability Scoring System. A standardized Severity score from 0 to 10.
EPSS: Exploit Prediction Scoring System. The probability a CVE will be exploited in the next 30 days.
MSRC: Microsoft Security Response Center. Microsoft's Patch Tuesday advisories and KB-to-CVE mapping.
NVD: National Vulnerability Database (NIST). Authoritative CVE metadata and CVSS scores.
Ransomware: The vulnerability is linked to known ransomware activity.

Please link to this page to stay current.

Reference: Microsoft CVE and vulnerability management, the full CVE-to-patch lookup ranked by real-world risk, and the Microsoft patching guide, how Intune, Windows Autopatch, Defender, and Azure Update Manager fit together.

Data notice: this page, the feeds, and the API are provided as is, for informational purposes only, without warranty of any kind. Senserva, LLC does not guarantee the accuracy, completeness, or timeliness of third-party data (MSRC, NVD, CISA KEV, EPSS) and accepts no liability for actions taken based on it; verify against the authoritative vendor advisory before acting. Built daily with Senserva Trustworthy AI. All use of this data is subject to the Senserva EULA.