Microsoft Windows 11 Version 22H2 vulnerabilities
1,776 known vulnerabilities affecting microsoft/windows_11_version_22h2.
Total CVEs
1,776
CISA KEV
72
actively exploited
Public exploits
51
Exploited in wild
87
Severity breakdown
CRITICAL42HIGH1247MEDIUM479LOW8
Vulnerabilities
Page 47 of 89
CVE-2023-35340P3HIGHCVSS 7.8≥ 10.0.22621.0, < 10.0.22621.19922023-07-11
CVE-2023-35340 [HIGH] CWE-591 CVE-2023-35340: Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
nvd
CVE-2025-24994P3HIGHCVSS 7.3≥ 10.0.22621.0, < 10.0.22621.50392025-03-11
CVE-2025-24994 [HIGH] CWE-284 CVE-2025-24994: Improper access control in Windows Cross Device Service allows an authorized attacker to elevate pri
Improper access control in Windows Cross Device Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-27491P3HIGHCVSS 7.1≥ 10.0.22621.0, < 10.0.22621.51892025-04-08
CVE-2025-27491 [HIGH] CWE-416 CVE-2025-27491: Use after free in Windows Hyper-V allows an authorized attacker to execute code over a network.
Use after free in Windows Hyper-V allows an authorized attacker to execute code over a network.
nvd
CVE-2024-26232P3HIGHCVSS 7.3≥ 10.0.22621.0, < 10.0.22621.34472024-04-09
CVE-2024-26232 [HIGH] CWE-843 CVE-2024-26232: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
nvd
CVE-2024-43581P3HIGHCVSS 7.1≥ 10.0.22621.0, < 10.0.22621.43172024-10-08
CVE-2024-43581 [HIGH] CWE-73 CVE-2024-43581: Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
nvd
CVE-2025-32721P3HIGHCVSS 7.3≥ 10.0.22621.0, < 10.0.22621.54722025-06-10
CVE-2025-32721 [HIGH] CWE-59 CVE-2025-32721: Improper link resolution before file access ('link following') in Windows Recovery Driver allows an
Improper link resolution before file access ('link following') in Windows Recovery Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-49682P3HIGHCVSS 7.3≥ 10.0.22621.0, < 10.0.22621.56242025-07-08
CVE-2025-49682 [HIGH] CWE-416 CVE-2025-49682: Use after free in Windows Media allows an authorized attacker to elevate privileges locally.
Use after free in Windows Media allows an authorized attacker to elevate privileges locally.
nvd
CVE-2024-30076P3MEDIUMCVSS 6.8≥ 10.0.22621.0, < 10.0.22621.37372024-06-11
CVE-2024-30076 [MEDIUM] CWE-59 CVE-2024-30076: Windows Container Manager Service Elevation of Privilege Vulnerability
Windows Container Manager Service Elevation of Privilege Vulnerability
nvd
CVE-2025-59214P3MEDIUMCVSS 6.5≥ 10.0.22621.0, < 10.0.22621.60602025-10-14
CVE-2025-59214 [MEDIUM] CWE-200 CVE-2025-59214: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauth
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2025-49727P3HIGHCVSS 7.0≥ 10.0.22621.0, < 10.0.22621.56242025-07-08
CVE-2025-49727 [HIGH] CWE-122 CVE-2025-49727: Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privile
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-55340P3HIGHCVSS 7.0≥ 10.0.22621.0, < 10.0.22621.60602025-10-14
CVE-2025-55340 [HIGH] CWE-287 CVE-2025-55340: Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a
Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally.
nvd
CVE-2025-50166P3MEDIUMCVSS 6.5≥ 10.0.22621.0, < 10.0.22621.57682025-08-12
CVE-2025-50166 [MEDIUM] CWE-190 CVE-2025-50166: Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized a
Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized attacker to disclose information over a network.
nvd
CVE-2024-30084P3HIGHCVSS 7.0≥ 10.0.22621.0, < 10.0.22621.37372024-06-11
CVE-2024-30084 [HIGH] CWE-367 CVE-2024-30084: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
nvd
CVE-2025-59244P3MEDIUMCVSS 6.5≥ 10.0.22621.0, < 10.0.22621.60602025-10-14
CVE-2025-59244 [MEDIUM] CWE-73 CVE-2025-59244: External control of file name or path in Windows Core Shell allows an unauthorized attacker to perfo
External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2025-29809P3HIGHCVSS 7.1≥ 10.0.22621.0, < 10.0.22621.51892025-04-08
CVE-2025-29809 [HIGH] CWE-922 CVE-2025-29809: Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypas
Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally.
nvd
CVE-2024-21438P3HIGHCVSS 7.5≥ 10.0.22621.0, < 10.0.22621.32962024-03-12
CVE-2024-21438 [HIGH] CWE-369 CVE-2024-21438: Microsoft AllJoyn API Denial of Service Vulnerability
Microsoft AllJoyn API Denial of Service Vulnerability
nvd
CVE-2023-36709P3HIGHCVSS 7.5≥ 10.0.22621.0, < 10.0.22621.24282023-10-10
CVE-2023-36709 [HIGH] CWE-476 CVE-2023-36709: Microsoft AllJoyn API Denial of Service Vulnerability
Microsoft AllJoyn API Denial of Service Vulnerability
nvd
CVE-2024-38068P3HIGHCVSS 7.5≥ 10.0.22621.0, < 10.0.22621.38802024-07-09
CVE-2024-38068 [HIGH] CWE-400 CVE-2024-38068: Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability
Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability
nvd
CVE-2024-20687P3HIGHCVSS 7.5≥ 10.0.22621.0, < 10.0.22621.30072024-01-09
CVE-2024-20687 [HIGH] CWE-125 CVE-2024-20687: Microsoft AllJoyn API Denial of Service Vulnerability
Microsoft AllJoyn API Denial of Service Vulnerability
nvd
CVE-2025-21351P3HIGHCVSS 7.5≥ 10.0.22621.0, < 10.0.22621.48902025-02-11
CVE-2025-21351 [HIGH] CWE-400 CVE-2025-21351: Windows Active Directory Domain Services API Denial of Service Vulnerability
Windows Active Directory Domain Services API Denial of Service Vulnerability
nvd