The Fleet Problem: Stale Windows 10 Endpoints, a Live RMM Exploit

Week of 17 August 2026 | Compiled by Team Paringa

Two stories this week point at the same underlying issue for anyone running a fleet of Windows endpoints: the tooling and the operating systems keeping that fleet alive are both under active pressure, and "we'll deal with it later" is no longer a viable posture.

SECTION 1 - What Happened This Week

🔴 Windows 10 still runs one in six business PCs - and the CVE gap is 2.9x

Asset tracking firm Lansweeper's latest data shows Windows 10 still accounts for 16.9% of monitored Windows devices - "roughly one in six" - with migration now "stalling to a crawl" after the initial post-end-of-support wave. SMBs are worse off: 21.4% of SMB machines are still on Windows 10, rising to 23% in healthcare and pharma and 22.7% in consumer/retail, sectors where legacy hardware or vendor certification requirements make migration genuinely hard rather than just neglected.

The number that should worry anyone still on the fence: a Windows 10 device carries an average of 1,903 active CVEs against 652 on Windows 11 - a 2.9x exposure gap, and that figure already includes devices with ESU patches applied. Lansweeper's technical evangelist Esben Dochy flagged "patch diffing" as an accelerant - because Windows 11 fixes are public, attackers can reverse-engineer them to find the matching unpatched flaw still live on Windows 10, effectively handing attackers a map. Consumer ESU coverage runs to October 2027, commercial to October 2028 - but after that, nothing. And a meaningful share of the remaining estate isn't neglect: it's vendor-locked medical devices, retail POS systems tied to specific OS versions for compliance or warranty, and air-gapped systems where the risk has been knowingly accepted rather than managed.

This is a fleet visibility and prioritisation problem before it's a procurement problem. Most affected organisations don't have a clean, current inventory of which devices are Windows 10, which have ESU applied, and which are vendor-locked into staying that way - which is exactly the gap a managed fleet service closes.

Sources: Windows 10 refuses to die, and the security bill is coming due - The Register

"Migrate everyone to Windows 11" is not the actionable takeaway here - a chunk of that 16.9% genuinely can't move without a vendor certification cycle or hardware refresh that isn't on the calendar yet. The actionable takeaway is inventory: know exactly which devices are stuck, why, and what the compensating controls are. Any prospect who can't answer that in one meeting is a fleet-management conversation waiting to happen, not a security conversation.

🟡 The RMM tool MSPs trust just became the attack path

CISA added an actively exploited N-able N-central vulnerability (CVE-2026-18577, CVSS 8.2) to its Known Exploited Vulnerabilities catalog, giving US federal agencies just three days to patch - a compressed deadline CISA reserves for its highest-urgency risks. N-central is the RMM console thousands of MSPs use to manage customer systems from a single dashboard; successful exploitation hands an attacker "the same level of control normally reserved for trusted NOC and engineering staff," according to security firm Huntress, who observed real-world attacks pivoting from the console into managed endpoints and standing up Cloudflare tunnels for persistent access.

The flaw affects N-central releases before 2026.3 when the server is internet-exposed - and it's a second bite at an earlier bug (CVE-2026-18556) that N-able thought it had already closed. NHS England and Belgium's national cyber centre both issued their own urgent advisories. By 3 August, Huntress reported nearly all cloud-hosted N-central instances patched, but 28.6% of self-hosted servers remained vulnerable and exposed to the internet days after disclosure.

Sources: Feds get 3 days to patch N-able God mode flaw under active exploit - The Register

This is the uncomfortable irony of MSP tooling: the single-pane-of-glass console that makes fleet management efficient is also a single point of catastrophic compromise if it's exposed and unpatched. Any fleet management conversation should include "how is the management layer itself secured" as a standing question - not an afterthought. 28.6% still exposed days after a federal three-day deadline tells you patch discipline in this space is patchy at best.

SECTION 2 - What IT and Fleet Managers Are Dealing With

The structural shift underneath both stories is the same: fleets are getting harder to keep current, not easier. Rising DRAM and component costs are pushing up the price of replacement hardware just as the Windows 10 deadline forces a refresh decision, and Windows 11 adoption has stalled at a plateau rather than continuing its post-EOL surge - Statcounter shows little movement in the OS split over the last few months. Meanwhile the tools MSPs and internal IT teams rely on to manage that estate at scale are themselves increasingly targeted, because compromising one RMM console gives an attacker leverage over every downstream endpoint it touches.

The net effect: "set and forget" fleet management is no longer a credible operating model. Visibility (what's on the estate, what state it's in) and active patch discipline (both on endpoints and on the management layer itself) are now the baseline, not an upsell.

Three Things Worth Watching Next Week

1. N-able self-hosted patch rate - if that 28.6% unpatched figure hasn't dropped sharply, expect follow-on exploitation reports naming affected MSPs.

2. Windows 10 ESU enrolment numbers - Microsoft's muted extension messaging suggests it's aware take-up is soft; watch for a harder push as October 2026 nears.

3. PC refresh pricing - rising DRAM costs colliding with a forced Windows 11 refresh cycle is a squeeze worth tracking for hardware budget conversations.

Questions? hello@paringa.ai

Paringa works with TruOffice to give organisations continuous visibility and managed support across the Windows fleet - so stale endpoints and unpatched management tooling stop being someone else's problem to discover during an incident. | 17 August 2026 | © Paringa Ltd