Microsoft Windows Server 2008 Service Pack 2 vulnerabilities
1,672 known vulnerabilities affecting microsoft/windows_server_2008_service_pack_2.
Total CVEs
1,672
CISA KEV
66
actively exploited
Public exploits
61
Exploited in wild
86
Severity breakdown
CRITICAL68HIGH1214MEDIUM387LOW3
Vulnerabilities
Page 33 of 84
CVE-2019-1057P3HIGHCVSS 7.5≥ 6.0.0, < publication2019-08-14
CVE-2019-1057 [HIGH] CWE-611 CVE-2019-1057: A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser proce
A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input. An attacker who successfully exploited the vulnerability could run malicious code remotely to take control of the user’s system.
To exploit the vulnerability, an attacker could host a specially crafted website designed to invoke MSXML thr
nvd
CVE-2024-29995P3HIGHCVSS 8.1≥ 6.0.6003.0, < 6.0.6003.228252024-08-13
CVE-2024-29995 [HIGH] CWE-208 CVE-2024-29995: Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
nvd
CVE-2021-34442P3HIGHCVSS 7.5≥ 6.0.0, < 6.0.6003.211672021-07-16
CVE-2021-34442 [HIGH] CVE-2021-34442: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2021-26882P3HIGHCVSS 7.8≥ 6.0.0, < publication2021-03-11
CVE-2021-26882 [HIGH] CVE-2021-26882: Remote Access API Elevation of Privilege Vulnerability
Remote Access API Elevation of Privilege Vulnerability
nvd
CVE-2023-23410P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.219662023-03-14
CVE-2023-23410 [HIGH] CWE-190 CVE-2023-23410: Windows HTTP.sys Elevation of Privilege Vulnerability
Windows HTTP.sys Elevation of Privilege Vulnerability
nvd
CVE-2025-26673P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.232202025-04-08
CVE-2025-26673 [HIGH] CWE-400 CVE-2025-26673: Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-27469P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.232202025-04-08
CVE-2025-27469 [HIGH] CWE-400 CVE-2025-27469: Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
nvd
CVE-2022-30149P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.215072022-06-15
CVE-2022-30149 [HIGH] CVE-2022-30149: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2022-30143P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.215072022-06-15
CVE-2022-30143 [HIGH] CVE-2022-30143: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2022-30146P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.215072022-06-15
CVE-2022-30146 [HIGH] CVE-2022-30146: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2025-47955P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.233172025-06-10
CVE-2025-47955 [HIGH] CWE-269 CVE-2025-47955: Improper privilege management in Windows Remote Access Connection Manager allows an authorized attac
Improper privilege management in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-26686P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.232202025-04-08
CVE-2025-26686 [HIGH] CWE-591 CVE-2025-26686: Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker
Sensitive data storage in improperly locked memory in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
nvd
CVE-2024-30015P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.226682024-05-14
CVE-2024-30015 [HIGH] CWE-197 CVE-2024-30015: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
nvd
CVE-2024-30029P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.226682024-05-14
CVE-2024-30029 [HIGH] CWE-197 CVE-2024-30029: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
nvd
CVE-2024-30014P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.226682024-05-14
CVE-2024-30014 [HIGH] CWE-197 CVE-2024-30014: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
nvd
CVE-2025-62455P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.236662025-12-09
CVE-2025-62455 [HIGH] CWE-20 CVE-2025-62455: Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privil
Improper input validation in Windows Message Queuing allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-53132P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.234712025-08-12
CVE-2025-53132 [HIGH] CWE-362 CVE-2025-53132: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-60703P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.236242025-11-11
CVE-2025-60703 [HIGH] CWE-822 CVE-2025-60703: Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate pri
Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-60720P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.236242025-11-11
CVE-2025-60720 [HIGH] CWE-126 CVE-2025-60720: Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.
Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-49675P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.234182025-07-08
CVE-2025-49675 [HIGH] CWE-416 CVE-2025-49675: Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate
Use after free in Kernel Streaming WOW Thunk Service Driver allows an authorized attacker to elevate privileges locally.
nvd