Microsoft Windows Server 2008 Service Pack 2 vulnerabilities
1,694 known vulnerabilities affecting microsoft/windows_server_2008_service_pack_2.
Total CVEs
1,694
CISA KEV
67
actively exploited
Public exploits
64
Exploited in wild
89
Severity breakdown
CRITICAL69HIGH1231MEDIUM391LOW3
Vulnerabilities
Page 46 of 85
CVE-2023-21726P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.218722023-01-10
CVE-2023-21726 [HIGH] CWE-257 CVE-2023-21726: Windows Credential Manager User Interface Elevation of Privilege Vulnerability
Windows Credential Manager User Interface Elevation of Privilege Vulnerability
nvd
CVE-2026-20816P3HIGHCVSS 7.0≥ 6.0.6003.0, < 6.0.6003.237172026-01-13
CVE-2026-20816 [HIGH] CWE-367 CVE-2026-20816: Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker
Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-53154P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.234712025-08-12
CVE-2025-53154 [HIGH] CWE-476 CVE-2025-53154: Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attac
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-53141P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.234712025-08-12
CVE-2025-53141 [HIGH] CWE-476 CVE-2025-53141: Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attac
Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
nvd
CVE-2023-35328P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.221752023-07-11
CVE-2023-35328 [HIGH] CWE-197 CVE-2023-35328: Windows Transaction Manager Elevation of Privilege Vulnerability
Windows Transaction Manager Elevation of Privilege Vulnerability
nvd
CVE-2025-47985P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.234182025-07-08
CVE-2025-47985 [HIGH] CWE-822 CVE-2025-47985: Untrusted pointer dereference in Windows Event Tracing allows an authorized attacker to elevate priv
Untrusted pointer dereference in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
nvd
CVE-2023-35299P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.221752023-07-11
CVE-2023-35299 [HIGH] CWE-125 CVE-2023-35299: Windows Common Log File System Driver Elevation of Privilege Vulnerability
Windows Common Log File System Driver Elevation of Privilege Vulnerability
nvd
CVE-2025-55230P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.234182025-08-21
CVE-2025-55230 [HIGH] CWE-822 CVE-2025-55230: Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to eleva
Untrusted pointer dereference in Windows MBT Transport driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-21197P3MEDIUMCVSS 6.5≥ 6.0.6003.0, < 6.0.6003.232202025-04-08
CVE-2025-21197 [MEDIUM] CWE-284 CVE-2025-21197: Improper access control in Windows NTFS allows an authorized attacker to disclose file path informat
Improper access control in Windows NTFS allows an authorized attacker to disclose file path information under a folder where the attacker doesn't have permission to list content.
nvd
CVE-2025-62213P3HIGHCVSS 7.0≥ 6.0.6003.0, < 6.0.6003.236242025-11-11
CVE-2025-62213 [HIGH] CWE-416 CVE-2025-62213: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to ele
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
nvd
CVE-2020-0836P3HIGHCVSS 7.5≥ 6.0.0, < publication2020-09-11
CVE-2020-0836 [HIGH] CVE-2020-0836: <p>A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries.
A denial of service vulnerability exists in Windows DNS when it fails to properly handle queries. An attacker who successfully exploited this vulnerability could cause the DNS service to become nonresponsive.
To exploit the vulnerability, an authenticated attacker could send malicious DNS queries to a target, resulting in a denial of service.
The update address
nvd
CVE-2020-1554P3HIGHCVSS 7.8≥ 6.0.0, < publication2020-08-17
CVE-2020-1554 [HIGH] CWE-787 CVE-2020-1554: A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in
A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights.
There are multiple ways an attacker could exploit the vulnerability, such as by convincin
nvd
CVE-2020-1379P3HIGHCVSS 7.8≥ 6.0.0, < publication2020-08-17
CVE-2020-1379 [HIGH] CWE-787 CVE-2020-1379: A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in
A memory corruption vulnerability exists when Windows Media Foundation improperly handles objects in memory. An attacker who successfully exploited the vulnerability could install programs; view, change, or delete data; or create new accounts with full user rights.
There are multiple ways an attacker could exploit the vulnerability, such as by convincin
nvd
CVE-2021-1734P3HIGHCVSS 7.5≥ 6.0.0, < publication2021-02-25
CVE-2021-1734 [HIGH] CVE-2021-1734: Windows Remote Procedure Call Information Disclosure Vulnerability
Windows Remote Procedure Call Information Disclosure Vulnerability
nvd
CVE-2022-37985P4MEDIUMCVSS 5.5≥ 6.0.6003.0, < 6.0.6003.217212022-10-11
CVE-2022-37985 [MEDIUM] CVE-2022-37985: Windows Graphics Component Information Disclosure Vulnerability
Windows Graphics Component Information Disclosure Vulnerability
nvd
CVE-2023-35383P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.222162023-08-08
CVE-2023-35383 [HIGH] CWE-190 CVE-2023-35383: Microsoft Message Queuing Information Disclosure Vulnerability
Microsoft Message Queuing Information Disclosure Vulnerability
nvd
CVE-2021-27077P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.210702021-03-11
CVE-2021-27077 [HIGH] CWE-269 CVE-2021-27077: Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability
nvd
CVE-2022-30166P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.215072022-06-15
CVE-2022-30166 [HIGH] CVE-2022-30166: Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
nvd
CVE-2023-36567P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.223172023-10-10
CVE-2023-36567 [HIGH] CWE-908 CVE-2023-36567: Windows Deployment Services Information Disclosure Vulnerability
Windows Deployment Services Information Disclosure Vulnerability
nvd
CVE-2021-26862P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.210702021-03-11
CVE-2021-26862 [HIGH] CWE-59 CVE-2021-26862: Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability
nvd