More than nine months after Microsoft ended standard support for Windows 10, millions of PCs continue to run the aging operating system. New asset data suggests those holdouts may be carrying considerably more known security exposure than devices running Windows 11.
Windows 10 devices in Lansweeper's monitored dataset had an average of 1,903 active CVEs, compared with 652 on Windows 11 devices. The asset-management company based its July 14, 2026, analysis on a subset of millions of devices across tens of thousands of customer sites.
The nearly threefold difference does not mean every Windows 10 PC is under attack or that a specific computer is likely to be breached. It does show that the Windows 10 devices in the dataset carried considerably more detected vulnerability exposure than their Windows 11 counterparts.
Why the vulnerability gap is growing
Microsoft ended standard support for Windows 10 Home and Pro on October 14, 2025. Most unenrolled PCs running those editions no longer receive regular operating-system security updates, feature updates, or technical support. Some Long-Term Servicing Channel and specialized editions follow separate lifecycles.
Windows 11 remains supported and continues to receive fixes for newly discovered security problems. Windows 10 devices outside Extended Security Updates, or ESU, do not receive equivalent fixes from Microsoft when new Windows 10 vulnerabilities are identified.
The severity breakdown in Lansweeper's findings is also notable. Of the active CVEs detected on its Windows 10 devices, 66.6% were rated high or critical. Another 2.4% were classified as known to be exploited in the wild.
That 2.4% figure does not mean the same share of Windows 10 PCs has been attacked. It means some of the vulnerabilities detected across the monitored systems are already being used in real-world attacks.
Lansweeper's public analysis does not fully detail whether the totals contain only Windows vulnerabilities or also include flaws tied to installed applications and other components. The figures are best read as a comparison of detected exposure across monitored devices, not as an OS-only security score or a prediction of whether an individual PC will be compromised.
What Extended Security Updates cover
Users who need more time can enroll eligible Windows 10 version 22H2 devices in ESU. According to Microsoft's Windows 10 ESU documentation, the program provides critical and important security updates but does not include new features, requested nonsecurity fixes, design changes, or general Windows technical support.
Microsoft extended consumer ESU coverage through October 12, 2027. Eligible personal PCs can enroll by syncing their settings with Windows Backup at no additional cost, redeeming 1,000 Microsoft Rewards points, or paying $30, although enrollment options and prices may vary by region. Microsoft confirmed the additional year in a June 25, 2026, update.
Commercial organizations follow a different program. Year 1 costs $61 per device, and the price doubles in each subsequent year for a maximum of three years. Coverage is cumulative, meaning an organization that enrolls during Year 2 must also pay for Year 1.
Only 14% of the Windows 10 assets in Lansweeper's dataset had ESU patches applied. That percentage should not be treated as a worldwide consumer enrollment rate, but it indicates that most Windows 10 devices in the company's monitored estate had not received ESU coverage.
Microsoft 365 has a separate support schedule. The apps may continue working on Windows 10, and Microsoft 365 security updates will continue through October 10, 2028. Microsoft will not provide new features or other general support for Microsoft 365 on Windows 10 during that period.
For consumer subscribers using the Current Channel, the final feature update is scheduled for August 2026. The applications may continue to work afterward, but Windows 10 users should not expect additional Microsoft 365 features.
Why some Windows 10 PCs remain stuck
Some Windows 10 systems support specialized business software, medical equipment, point-of-sale tools, or other vendor-controlled configurations that cannot be changed without testing or approval. Other users have delayed upgrading because of replacement costs, peripheral compatibility, or uncertainty about Windows 11.
Hardware incompatibility affected a smaller portion of Lansweeper's Windows 10 dataset than might be expected. The company found that 2.8% of those systems failed Windows 11's hardware requirements outright.
Before replacing a computer, run Microsoft's PC Health Check app to identify the specific compatibility problem. Windows 11 requires a supported 64-bit processor, TPM 2.0, at least 4GB of memory, 64GB of storage, and UEFI firmware with Secure Boot capability.
A PC may appear incompatible because TPM 2.0 or Secure Boot is disabled in its firmware rather than missing from the device. Enabling the appropriate setting may make the computer eligible. Systems with unsupported processors or missing security hardware may require replacement for an officially supported Windows 11 installation.
Unofficial workarounds can install Windows 11 on some ineligible PCs, but Microsoft does not consider that a supported upgrade. The company warns that unsupported Windows 11 devices may encounter compatibility problems and are not guaranteed to receive updates, including security updates.
What Windows 10 users should do now
Start by checking which situation applies to your computer.
The PC qualifies for Windows 11: Back up important files, confirm that essential applications and peripherals are compatible, and install the upgrade through Windows Update when it is offered.
The PC appears ineligible: Run PC Health Check and verify that TPM 2.0 and Secure Boot are enabled before deciding that the hardware must be replaced.
The PC cannot run Windows 11: Enroll an eligible personal device in ESU for temporary security coverage, or plan to replace or repurpose it before consumer ESU ends on October 12, 2027.
Windows 10 will continue to start and run after consumer ESU expires on October 12, 2027. Unless Microsoft extends the program again, however, enrolled personal devices will stop receiving those security updates.
ESU gives Windows 10 users more time, not a permanent solution. Checking compatibility now can reveal whether the computer needs only a firmware change, a routine Windows 11 upgrade, or an eventual replacement—before the final security deadline arrives.
Comments
Be the first, drop a comment!