[Blog](/blog) Show links Resources [Blog](/blog) [Breaches](/breaches) [eBooks, reports, & more](/resources) [Events](/events) [News](/news) [Attack Surface Management](/category/attack-surface-management) Show links Categories [Attack Surface Management](/category/attack-surface-management) [Company News](/category/company-news) [Compliance and Regulations](/category/compliance-and-regulations) [Cybersecurity](/category/cybersecurity) [Data Breaches](/category/data-breaches) [DevOps](/category/devops) [Human Cyber Risk](/category/human-cyber-risk) [Risks and Vulnerabilities](/category/risks-and-vulnerabilities) [Third-Party Risk Management](/category/third-party-risk-management) [Vendor Risk Management](/category/vendor-risk-management) [How to Fix the Top 10 Windows 10 Vulnerabilities \[Infographic\]](/blog/top-10-windows-10-security-vulnerabilities-and-how-to-fix-them) Publish date January 7, 2025 {x} minute read # How to Fix the Top 10 Windows 10 Vulnerabilities \[Infographic] [Get a demo](/contact-sales) [Free trial](/demo) [Download the PDF guide](/resources/complete-guide-to-data-breaches) [Free trial](/demo) Written by [Abi Tyas Tunggal](/team/abi-tyas-tunggal) Writer and Senior Product Manager at UpGuard. Abi's work has influenced leaders across cybersecurity, technology, and financial services. Reviewed by [Kaushik Sen](/team/kaushik-sen) Chief Marketing Officer Kaushik has a background in software engineering, enterprise solution architecture, and data analytics. He brings a unique, data-driven perspective to cybersecurity education. Table of contents eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) Genuine Windows 7 or Windows 8/8.1 owners are in for a pre-holiday treat from Microsoft: a free upgrade to Windows 10, no strings attached. Security-conscious users will appreciate some new features that enable better security—namely Windows Device Guard, Hello, and Passport. Despite these nifty additions for bolstering one’s desktop [security posture](/blog/security-posture), Windows 10 certainly hasn’t been without its own critical security flaws. All software is prone to quality gaps and vulnerabilities—staying on top of these items is key to preventing systems from being exploited. The following are the top 10 Windows 10 vulnerabilities to-date and how to address them. ## Top 10 Windows 10 Vulnerabilities ### 10. Windows 10 Mount Manager Vulnerability (CVE-2015-1769, MS15-085)*** *** This [vulnerability](/blog/vulnerability) involves potential [escalation of privilege](/blog/privilege-escalation) by inserting a USB device into the target system. Through this method, an attacker could write a malicious binary to disk and execute the code. [An update](https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-085) is available from Microsoft to patch this vulnerability. ### 9. Microsoft Edge Vulnerabilities (MS15-091)*** *** The Edge browser's predecessor Internet Explorer was not the highest rated in terms of security, to say the least—and Edge seems to also be getting off to a rough start, security-wise. Various remote-code execution vulnerabilities and security feature bypass exploits can allow attackers to gain control over systems. More information and patching instructions are available on [this item's security bulletin page.](https://support.microsoft.com/en-us/help/3084525/ms15-091-cumulative-security-update-for-microsoft-edge-august-11-2015) ### 8. Microsoft Graphics Component Vulnerabilities (MS15-080)*** *** This grouping of vulnerabilities is related to various font and graphics memory-management flaws that could ultimately result in remote code execution if visiting an untrusted website with embedded fonts. Detailed patching information can be had on the [item's security bulletin](https://support.microsoft.com/en-us/help/3078662/ms15-080-vulnerabilities-in-microsoft-graphics-component-could-allow-r). ### 7. Internet Explorer Vulnerabilities (MS15-079) Microsoft's famously maligned web browser has a slew of new vulnerabilities with Windows 10, the most serious of them allowing attackers to gain the system rights of the user. More information and patching details are available on the [item's security bulletin page.](https://support.microsoft.com/en-us/help/3082442/ms15-079-cumulative-security-update-for-internet-explorer-august-11-20) ### 6. Microsoft Windows Journal Vulnerability (MS15-098) This vulnerability could allow remote code execution to occur if users open a specially-crafted Journal file. More information and a patch is available on this item's [security bulletin page.](https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-098) ### 5. Re-Direct to SMB Vulnerability (CVE-2015-5143)  This security flaw impacts all versions of Windows—including Windows 10—and primarily involves a core Windows API library and how Windows connects to SMB. This could result in Windows users being redirected to malicious SMB-based servers and having their encrypted login credentials stolen. The most effective way mitigate this [cyber threat](https://www.upguard.com/blog/cyber-threat) is to block [TCP ports 139 and 445 to disable SMB](/blog/smb-port). ### 4. .NET Framework Escalation of Privilege Vulnerability (MS15-092)* * Custom-crafted .NET applications can cause escalation of [privilege exploits](/blog/privilege-escalation) to occur. However, users must be first convinced/tricked into running said applications. More information and patch instructions are available on this item's [security bulleting page](https://support.microsoft.com/en-us/help/3086251/ms15-092-vulnerabilities-in-the-net-framework-could-allow-elevation-of). ### 3. Microsoft Font Driver Vulnerability (MS15-078) Windows Adobe Type Manager improperly handles specially-crafted OpenType fonts, which can result in a remote code execution vulnerability. This may lead to attackers gaining complete control of the system to install programs, view/change/delete data, and create new accounts. Though Microsoft has auto-patched this flaw in the wild, the patch can also be [manually downloaded and installed.](https://support.microsoft.com/en-us/help/3079904/ms15-078-vulnerability-in-microsoft-font-driver-could-allow-remote-cod) ### 2. Windows 10 WiFi Sense Contact Sharing* * By default, Windows 10 will share your wifi credentials to Outlook, Skype, and Facebook contacts—presumably to make wifi and hotspot sharing easier. This makes it possible for any of these said contacts to hop onto your wifi network—if in proximity—without authorization. While not necessarily a software vulnerability, this feature can lead to compromises, and should be remediated through the following steps: * Change the wifi network name/SSID to include the terms “\_nomap\_optout," prior to upgrading to Windows 10 * Post-upgrade, change your Windows privacy settings  to disable Wi-Fi Sense sharing. ### 1. Win32k Elevation of Privilege Vulnerability (CVE-2015-0057)* * This vulnerability involving a flaw in a GUI component of Windows 10—namely the scrollbar element—allows a threat actor to gain complete control of a Windows machine through [privilege escalation](/blog/privilege-escalation). Microsoft has made a [patch available](https://docs.microsoft.com/en-us/security-updates/SecurityBulletins/2015/ms15-010) for fixing this flaw. ## Remediation **‍**To fix the above vulnerabilities, you'll need to identify all the required updates as noted by Windows Update. Alternatively, UpGuard provides a way for you to do this easily and automatically—across your whole environment—with a few mouse clicks. Our powerful policy engine can validate secure configurations for all environments, infrastructures, and application stacks. In this case, a simple Windows 10 security policy can be run to check for any of the above vulnerabilities—as well as new vulnerabilities not yet added to policy. Our OVAL-backed vulnerability detection and monitoring suite ensures that all Windows 10 nodes in your environment are free for vulnerabilities and security flaws. ## Sources ## Infographic eBook A Complete Guide to Data Breaches Free resource ### A Complete Guide to Data Breaches Learn how to avoid a costly data breach with a comprehensive prevention strategy. [Download now](/resources/complete-guide-to-data-breaches) ## Related posts Learn more about the latest issues in cybersecurity. Attack Surface Management #### [Find Out if You're Exposed on the Dark Web](/blog/find-out-if-youre-exposed-on-the-dark-web) Answer 5 quick questions to predict what a dark web scan will find about your company. Then run the free scan to see your real exposure. [](/team/lance-turner) [Lance Turner](#) October 14, 2026 Data Breaches #### [Your First Dark Web Scan Report, Explained](/blog/your-first-dark-web-scan-report-explained) You scanned your domain. What do the results mean? [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [12 Cybersecurity Horror Stories of 2026 (No Costume Required)](/blog/cybersecurity-horror-stories-2026) A warning ignored once becomes a headline. Read more about these 12 real 2026 cybersecurity incidents, and the sign each one gave before it made the news. [](/team/revashni-moodley) [Revashni Moodley](#) October 14, 2026 Data Breaches #### [Good Security Rating? Your Dark Web Exposure Says Otherwise](/blog/good-security-rating-your-dark-web-exposure-says-otherwise) Scan your domain to see just how exposed you are on the Dark Web. [](/team/lance-turner) [Lance Turner](#) October 13, 2026 Cybersecurity #### [Left Unsupervised: 10 Times Access Outlived Its Authorization](/blog/10-times-access-outlived-authorization) Access granted once shouldn’t mean access forever. Read more on how unmonitored access caused 10 of these real-life breaches and what they taught us. [](/team/revashni-moodley) [Revashni Moodley](#) August 25, 2026 Cybersecurity #### [Surviving a LockBit Ransomware Attack: The ROI of Visibility](/blog/surviving-a-lockbit-ransomware-attack) Read how veteran CISO Nick Gicinto saved his alma mater from a LockBit ransomware attack by discarding the standard playbook. [](/team/nicholas-sollitto) [Nicholas Sollitto](#) June 1, 2026 [All posts](/blog) Experience superior visibility and a simpler approach to cyber risk management [Get a demo](/contact-sales) [Free trial](/demo)