Version: Default* | Print Friendly With Images | Print Friendly Without Images
For: Windows 11
Last Reviewed/Updated: 16 Mar 2026 | Published: 14 Jan 2004 | Status: Active
Some Windows vulnerabilities can be exploited without user interaction as soon as the computer is placed online. Therefore, after performing a clean installation of Windows, it is necessary to resolve the known examples of these vulnerabilities before placing the computer online, including before running Windows Update.
1.1. Windows Vulnerabilities And Worms
Windows vulnerabilities are flaws in the Windows operating system code that render Windows susceptible to exploitation. The successful exploitation of a Windows vulnerability results in compromise. Toward securing Windows, it is instructive to divide Windows vulnerabilities into two groups: 1.) those that require user interaction to be exploited, and 2.) those that do not require user interaction to be exploited.
For the Windows vulnerabilities that require user interaction to be exploited, compromise requires user interaction on the computer besides placing the vulnerable computer online (i.e., connecting the computer to a network, be it an Intranet and/or the Internet). User interactions that can result in compromise, known as triggers, include attaching external/removable drives or network devices, visiting Web sites, accessing/receiving/opening emails, opening email attachments, creating/accessing/opening/installing/joining/connecting to network resources including but not limited to servers/domains/devices/shares/files/etc. In other words, for the Windows vulnerabilities that require user interaction to be exploited, in the absence of the appropriate user interaction required to trigger exploitation, compromise cannot occur simply by placing the vulnerable computer online.
For the Windows vulnerabilities that do not require user interaction to be exploited, compromise does not require any user interaction on the computer besides placing the vulnerable computer online. In other words, for the Windows vulnerabilities that do not require user interaction to be exploited, there is no trigger and compromise can occur simply by placing the vulnerable computer online.
After installing Windows 11, a common practice is to place the computer online and run Windows Update to install the latest Cumulative Update for Windows 11. Although the intention (to secure Windows) is good, this practice is bad. Why? Because, for the Windows vulnerabilities that do not require user interaction to be exploited, compromise can occur simply by placing the vulnerable computer online, and this includes during the time that Windows Update is running.
Worms are the class of threat that automatically run themselves on, and automatically copy themselves from, computer to computer over a network without user interaction. To accomplishes this, worms exploit vulnerabilities that, themselves, do not require user interaction to be exploited and that allow remote code execution (RCE). First, the worm exploits the vulnerability, then it runs itself on the now compromised computer, including possibly delivering a destructive payload, and then it attempts to propagate itself to other vulnerable computers on the network, again without user interaction.
Worms are extremely dangerous because they can automatically infect a tremendous number of vulnerable networked computers seemingly simultaneously without any user interaction besides placing the vulnerable computers online. Infamous worms that exploit Windows vulnerabilities include:
Worms Blaster, Welchia, Sasser, Conficker, and Wannacry remain so prevalent that even today - years after they have been discovered - vulnerable Windows computers are still being compromised by these worms as soon as they are placed online, including during the time that Windows Update is running.
Fortunately, most of the Windows vulnerabilities that do not require user interaction to be exploited are not wormable (i.e., do not allow RCE and, therefore, are not suitable for worms). Instead, the impact of most Windows vulnerabilities that do not require user interaction to be exploited is to allow either denial of service, elevation of privilege (EOP), information disclosure, security feature bypass, or spoofing. However, wormable Windows vulnerabilities are found every year. For example, CVE-2022-21907 (cve.mitre.org), released in Jan 2022, describes a wormable Windows 11 vulnerability. Whether or not a worm will be developed to exploit this vulnerability only time will tell.
The exploitability (i.e., the likelihood that a vulnerability will be exploited) of a Windows vulnerability that does not require user interaction to be exploited depends on the computer's network environment. For a computer that is directly connected to the Internet (i.e., for a computer that is assigned a public IP address because it is not behind a gateway/router), the exploitability of a Windows vulnerability that does not require user interaction to be exploited is high. For a computer that is connected to a local network (i.e., for a computer that is assigned a private IP address because it is behind a gateway/router), the exploitability of a Windows vulnerability that does not require user interaction to be exploited is relatively low. Note, however, that some worms (e.g., Downadup (a.k.a., Conficker)) can transfer across (i.e., bridge) gateways/routers. Hence, rather than trying to take network environment, exploitability, severity rating, impact, and other factors into account, thereby, driving oneself mad in the process, a simpler and safer policy has been adopted for this web page: to secure a clean installation of Windows, it is necessary to resolve all known Windows vulnerabilities that do not require user interaction to be exploited before placing the computer online, not after placing the computer online.
1.2. Windows 11 Servicing Model: Cumulative Updates
Microsoft first released Windows 11 (Windows 11 Version 21H2) in October 2021. Microsoft intends to release a new version of Windows 11 once a year, in the second half of the year.
On the second Tuesday of each month, Microsoft releases a Cumulative Update (a.k.a., Quality Update) for the supported versions of Windows 11. Microsoft intends to support each version of Windows 11 Home and Pro with Cumulative Updates for 24 months:
| Windows 11 Versions Support Status (Last Reviewed/Updated: 16 Mar 2026) |
|||||
| Windows (Build) |
11 Version 21H2 (10.0.22000.194) |
11 Version 22H2 (10.0.22621.521) (1) |
11 Version 23H2 (10.0.22631.2428) |
11 Version 24H2 (10.0.26100.1742) |
11 Version 25H2 (10.0.26200.6584) |
|---|---|---|---|---|---|
| General Availability |
04 Oct 2021 | 20 Sep 2022 (2) | 31 Oct 2023 | 01 Oct 2024 | 30 Sep 2025 |
| In Support | No | Yes | |||
| (1)(2) Windows 11 Version 22H2 general availability was announced on 20 Sep 2022 when Windows 11 Version 22H2 was at build 10.0.22621.521. However, apparently the first build of Windows 11 Version 22H2 released through official channels as a general availability ISO was 10.0.22621.525 on 28 Sep 2022, not 10.0.22621.521 on 20 Sep 2022. | |||||
In the Windows 11 servicing model, a Cumulative Update for Windows 11 is a single file that contains new security and non-security fixes, and all previous security and non-security fixes (if there are any), for a version of Windows 11. In other words, in the Windows 11 servicing model, Cumulative Updates for Windows 11 are cumulative back through the initial release of the version of Windows 11. This means that to obtain the security (and non-security) fixes for Windows 11 from the initial release of the version of Windows 11 through the present, it is only necessary to install the latest Cumulative Update (LCU) for Windows 11 for the supported version of Windows 11.
1.3. Windows 11 Servicing Stack Updates
Servicing is the process of installing a Cumulative Update, Security Update, Update, fix, component, role, etc. Depending on what is being installed, servicing is performed manually by the user and/or automatically by Windows Update. The Servicing Stack is the component of Windows that performs servicing. Like other Windows components, the Servicing Stack is periodically updated. A Servicing Stack Update (SSU) improves the speed and reliability of servicing.
The Servicing Stack Updates for Windows 11 are included in the Cumulative Updates for Windows 11. Therefore, for Windows 11 there is no need to worry about Servicing Stack Updates.
1.4. Overview: How To Secure A Clean Installation Of Windows 11
To secure a clean installation of Windows per this web page, it is necessary to resolve all known Windows vulnerabilities that do not require user interaction to be exploited before placing the computer online. Rather than read the documentation for the latest Cumulative Update for Windows 11 to try to determine if the Cumulative Update resolves any wormable Windows vulnerabilities, it is far simpler to download the latest Cumulative Update for Windows 11, to copy the Cumulative Update to removable media, and to install the Cumulative Update before placing the computer online. Accordingly, the following is an overview of how to secure a clean installation of Windows 11 per this web page.
2. Files To Download And Copy To CD/DVD Before Performing The Clean Installation Of Windows 11
To secure a clean installation of Windows per this web page, it is necessary to resolve all known Windows vulnerabilities that do not require user interaction to be exploited before placing the computer online. This requires downloading and copying the latest Cumulative Update for Windows 11 to removable media before performing the clean installation of Windows 11. Because files on CDs/DVDs are far more difficult manipulate by malicious software/users than files on external hard disk drives and flash memory drives, CDs/DVDs are the removable media of choice.
Using a computer that is not compromised, download and copy the following files to CD/DVD before performing the clean installation of Windows 11:
3. Secure A Clean Installation Of Windows 11
4. Resources And Additional Information