cbcvebase.

Microsoft Windows 11 Version 23H2 vulnerabilities

1,661 known vulnerabilities affecting microsoft/windows_11_version_23h2.

Total CVEs
1,661
CISA KEV
59
actively exploited
Public exploits
42
Exploited in wild
71
Severity breakdown
CRITICAL25HIGH1170MEDIUM458LOW8

Vulnerabilities

Page 47 of 84
CVE-2025-49680P3HIGHCVSS 7.3≥ 10.0.22631.0, < 10.0.22631.56242025-07-08
CVE-2025-49680 [HIGH] CWE-59 CVE-2025-49680: Improper link resolution before file access ('link following') in Windows Performance Recorder allow Improper link resolution before file access ('link following') in Windows Performance Recorder allows an authorized attacker to deny service locally.
nvd
CVE-2024-30076P3MEDIUMCVSS 6.8≥ 10.0.22631.0, < 10.0.22631.37372024-06-11
CVE-2024-30076 [MEDIUM] CWE-59 CVE-2024-30076: Windows Container Manager Service Elevation of Privilege Vulnerability Windows Container Manager Service Elevation of Privilege Vulnerability
nvd
CVE-2026-32093P3HIGHCVSS 7.0≥ 10.0.22631.0, < 10.0.22631.69362026-04-14
CVE-2026-32093 [HIGH] CWE-122 CVE-2026-32093: Concurrent execution using shared resource with improper synchronization ('race condition') in Funct Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-26151P3HIGHCVSS 7.1≥ 10.0.22631.0, < 10.0.22631.69362026-04-14
CVE-2026-26151 [HIGH] CWE-357 CVE-2026-26151: Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized att Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-21253P3HIGHCVSS 7.0≥ 10.0.22631.0, < 10.0.22631.66492026-02-10
CVE-2026-21253 [HIGH] CWE-416 CVE-2026-21253: Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally. Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-59214P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.60602025-10-14
CVE-2025-59214 [MEDIUM] CWE-200 CVE-2025-59214: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauth Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-21508P3HIGHCVSS 7.0≥ 10.0.22631.0, < 10.0.22631.66492026-02-10
CVE-2026-21508 [HIGH] CWE-287 CVE-2026-21508: Improper authentication in Windows Storage allows an authorized attacker to elevate privileges local Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-55340P3HIGHCVSS 7.0≥ 10.0.22631.0, < 10.0.22631.60602025-10-14
CVE-2025-55340 [HIGH] CWE-287 CVE-2025-55340: Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a Improper authentication in Windows Remote Desktop Protocol allows an authorized attacker to bypass a security feature locally.
nvd
CVE-2026-25171P3HIGHCVSS 7.0≥ 10.0.22631.0, < 10.0.22631.67832026-03-10
CVE-2026-25171 [HIGH] CWE-416 CVE-2026-25171: Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges Use after free in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-32087P3HIGHCVSS 7.0≥ 10.0.22631.0, < 10.0.22631.69362026-04-14
CVE-2026-32087 [HIGH] CWE-122 CVE-2026-32087: Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker t Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-20847P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.64912026-01-13
CVE-2026-20847 [MEDIUM] CWE-200 CVE-2026-20847: Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized att Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2025-50166P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.57682025-08-12
CVE-2025-50166 [MEDIUM] CWE-190 CVE-2025-50166: Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized a Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized attacker to disclose information over a network.
nvd
CVE-2024-30084P3HIGHCVSS 7.0≥ 10.0.22631.0, < 10.0.22631.37372024-06-11
CVE-2024-30084 [HIGH] CWE-367 CVE-2024-30084: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
nvd
CVE-2025-59185P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.60602025-10-14
CVE-2025-59185 [MEDIUM] CWE-73 CVE-2025-59185: External control of file name or path in Windows Core Shell allows an unauthorized attacker to perfo External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2025-62473P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.63452025-12-09
CVE-2025-62473 [MEDIUM] CWE-126 CVE-2025-62473: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-64670P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.63452025-12-09
CVE-2025-64670 [MEDIUM] CWE-200 CVE-2025-64670: Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information over a network.
nvd
CVE-2025-59244P3MEDIUMCVSS 6.5≥ 10.0.22631.0, < 10.0.22631.60602025-10-14
CVE-2025-59244 [MEDIUM] CWE-73 CVE-2025-59244: External control of file name or path in Windows Core Shell allows an unauthorized attacker to perfo External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2025-29809P3HIGHCVSS 7.1≥ 10.0.22631.0, < 10.0.22631.51892025-04-08
CVE-2025-29809 [HIGH] CWE-922 CVE-2025-29809: Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypas Insecure storage of sensitive information in Windows Kerberos allows an authorized attacker to bypass a security feature locally.
nvd
CVE-2024-21438P3HIGHCVSS 7.5≥ 10.0.22631.0, < 10.0.22631.32962024-03-12
CVE-2024-21438 [HIGH] CWE-369 CVE-2024-21438: Microsoft AllJoyn API Denial of Service Vulnerability Microsoft AllJoyn API Denial of Service Vulnerability
nvd
CVE-2024-38068P3HIGHCVSS 7.5≥ 10.0.22631.0, < 10.0.22631.38802024-07-09
CVE-2024-38068 [HIGH] CWE-400 CVE-2024-38068: Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability
nvd
← Previous47 / 84Next →