Is this build actually patched?
Other CVE checkers compare a version string. Windows version strings don’t carry the revision, so a fully patched machine reads as vulnerable. Give us the real build and revision and you get the answer plus the evidence behind it.
This one does send data. Your build number and any KBs you paste go to our API. We never log the KB list.1Get your real build number
winver won’t do, and neither will Environment.OSVersion.
Both drop the revision. Read it from the registry, where it actually lives:
(Get-ItemProperty 'HKLM:\SOFTWARE\Microsoft\Windows NT\CurrentVersion' |
ForEach-Object { "10.0.$($_.CurrentBuildNumber).$($_.UBR)" })
Optional, and it makes the answer sharper: add your installed updates with
Get-HotFix | Select-Object -Expand HotFixID. Some fixes ship in a standalone
update rather than the monthly rollup, and without the list we can only judge those by revision.
2Check it
Verdict
Why the revision is the whole answer
Take a fully patched Windows 11 machine. Ask Windows what version it is and it says
10.0.26200.0. Ask the registry and it says 10.0.26200.9457.
Same machine, same second.
Feed the first number to a checker that compares version strings and every CVE fixed in that
build family comes back as unpatched, because .0 is genuinely below every fixed
revision. It is the original RTM revision. The machine is fine; the number is wrong.
This is also why “unknown” appears on this page rather than a guess. If you give us a build with no revision, there is nothing to compare, and we would rather say so.
Questions
Why does my build end in .0 when I am fully patched?
Because Environment.OSVersion and winver both drop the Update Build Revision. A fully patched Windows 11 box reports 10.0.26200.0 while the machine itself is on 10.0.26200.9457. The UBR is the part that says whether this month's cumulative landed, so a tool that compares the string it was handed will call a patched machine vulnerable. That is the entire reason this page asks for a number you have to go and look up.
Where does the data come from?
Microsoft's own security update data (MSRC), which is what says which build revision fixes which CVE. We ingest it and compare it against the build you give us. We do not use CIS Benchmark content, and Microsoft publishes no first-party Windows OVAL, which is a large part of why nobody else answers this question well.
What does "unknown" mean? Why not just guess?
It means we can name what we are missing. Most often it is the revision: give us 10.0.26200 and there is no number to compare, so the honest answer is that we cannot tell you yet. A tool that guesses in that situation is right about half the time and confident every time, which is worse than useless when the output is a patch decision.
What is a supersedence chain?
Windows updates replace each other. The update that carried a fix is often not the one you have installed - you have a later one that superseded it, possibly through several steps. So the answer is not just "patched", it is "you are covered by KB5068202, which supersedes KB5065789, which carried the fix". That sentence is what you need when somebody asks you to prove it.
Does this send anything to you?
Yes, and it is the only tool on this site that does. The build number and any KB numbers you paste are sent to our API, because the comparison happens there rather than in your browser. We never log the KB list - only how many you sent. There is no account, no cookie, and nothing that identifies you beyond the request itself.
Why is the comparison not done in my browser?
Because it is a judgement, not a lookup. It needs the MSRC data, the applicability rules, and the full supersedence graph. Shipping that logic to the browser would mean maintaining it twice, and the second copy is always the one that drifts and starts giving different answers.
One machine at a time
This page answers for one build. If the question is “which of my 400 machines are exposed, and did last month’s patch actually land on all of them”, that is RFF - the agent reads the real build and UBR off every box and keeps the answer current without anyone pasting anything.