Windows 10 support ends, IPA warns of security risks
Japan's IPA warns Windows 10 support ended October 14, 2025 (US time), urging migration to supported OS versions to avoid exploitation of unpatched vulnerabilities.
Sourceipa.go.jp — open the original
What to check
- Applies to
- The 1 CVE named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2024-26169 as exploited in the wild.
Japan's Information-technology Promotion Agency (IPA) has issued an advisory regarding the end of support for Windows 10, which occurred on October 14, 2025 (US time). Following this date, Microsoft will no longer provide security updates for Windows 10 GAC (General Availability Channel) editions, including Enterprise, Education, Home, Pro, and IoT Enterprise versions. Users still operating these versions are urged to migrate immediately to supported operating systems or consider Microsoft's Extended Security Updates (ESU) program for transitional coverage.
The advisory highlights significant security risks associated with continuing to use unsupported operating systems. According to CISA's Known Exploited Vulnerabilities (KEV) catalog, 41 Windows OS vulnerabilities published since 2024 have been actively exploited as of September 2025, with 26 additions occurring between October 2024 and the advisory date. Several of these vulnerabilities, including CVE-2024-26169, have been leveraged specifically for ransomware deployment. Without vendor patches, organizations running Windows 10 face heightened risk of information disclosure, service disruption, and compromise.
IPA emphasizes that the support termination affects not only the operating system itself but also third-party applications running on Windows 10. Browsers, email clients, and other software products may lose vendor support on unsupported OS platforms, creating cascading security risks. Organizations are advised to inventory both OS and application dependencies and plan comprehensive migration strategies to supported platforms.
Mentioned in this report
Source reporting: https://www.ipa.go.jp/security/security-alert/2024/win10_eos.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs