Microsoft Windows Server 2008 Service Pack 2 vulnerabilities
1,672 known vulnerabilities affecting microsoft/windows_server_2008_service_pack_2.
Total CVEs
1,672
CISA KEV
66
actively exploited
Public exploits
61
Exploited in wild
86
Severity breakdown
CRITICAL68HIGH1214MEDIUM387LOW3
Vulnerabilities
Page 55 of 84
CVE-2023-36589P3HIGHCVSS 7.3≥ 6.0.6003.0, < 6.0.6003.223172023-10-10
CVE-2023-36589 [HIGH] CWE-94 CVE-2023-36589: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
nvd
CVE-2023-36570P3HIGHCVSS 7.3≥ 6.0.6003.0, < 6.0.6003.223172023-10-10
CVE-2023-36570 [HIGH] CWE-94 CVE-2023-36570: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
nvd
CVE-2023-36575P3HIGHCVSS 7.3≥ 6.0.6003.0, < 6.0.6003.223172023-10-10
CVE-2023-36575 [HIGH] CWE-94 CVE-2023-36575: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
nvd
CVE-2023-36572P3HIGHCVSS 7.3≥ 6.0.6003.0, < 6.0.6003.223172023-10-10
CVE-2023-36572 [HIGH] CWE-94 CVE-2023-36572: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
nvd
CVE-2023-36591P3HIGHCVSS 7.3≥ 6.0.6003.0, < 6.0.6003.223172023-10-10
CVE-2023-36591 [HIGH] CWE-94 CVE-2023-36591: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
nvd
CVE-2024-26216P3HIGHCVSS 7.3≥ 6.0.6003.0, < 6.0.6003.226182024-04-09
CVE-2024-26216 [HIGH] CWE-59 CVE-2024-26216: Windows File Server Resource Management Service Elevation of Privilege Vulnerability
Windows File Server Resource Management Service Elevation of Privilege Vulnerability
nvd
CVE-2021-28439P3HIGHCVSS 7.5≥ 6.0.0, < publication2021-04-13
CVE-2021-28439 [HIGH] CVE-2021-28439: Windows TCP/IP Driver Denial of Service Vulnerability
Windows TCP/IP Driver Denial of Service Vulnerability
nvd
CVE-2025-53140P3HIGHCVSS 7.0≥ 6.0.6003.0, < 6.0.6003.234712025-08-12
CVE-2025-53140 [HIGH] CWE-416 CVE-2025-53140: Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges loc
Use after free in Kernel Transaction Manager allows an authorized attacker to elevate privileges locally.
nvd
CVE-2020-1577P3MEDIUMCVSS 6.5≥ 6.0.0, < publication2020-08-17
CVE-2020-1577 [MEDIUM] CVE-2020-1577: An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of
An information disclosure vulnerability exists when DirectWrite improperly discloses the contents of its memory. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user’s system.
There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted
nvd
CVE-2025-21181P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.231172025-02-11
CVE-2025-21181 [HIGH] CWE-400 CVE-2025-21181: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
nvd
CVE-2024-26215P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.226182024-04-09
CVE-2024-26215 [HIGH] CWE-400 CVE-2024-26215: DHCP Server Service Denial of Service Vulnerability
DHCP Server Service Denial of Service Vulnerability
nvd
CVE-2025-21300P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.230702025-01-14
CVE-2025-21300 [HIGH] CWE-400 CVE-2025-21300: Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability
Windows Universal Plug and Play (UPnP) Device Host Denial of Service Vulnerability
nvd
CVE-2024-38236P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.228702024-09-10
CVE-2024-38236 [HIGH] CWE-400 CVE-2024-38236: DHCP Server Service Denial of Service Vulnerability
DHCP Server Service Denial of Service Vulnerability
nvd
CVE-2020-1491P3HIGHCVSS 7.8≥ 6.0.0, < publication2020-09-11
CVE-2020-1491 [HIGH] CVE-2020-1491: <p>An elevation of privilege vulnerability exists in the way that the Windows Function Discovery Ser
An elevation of privilege vulnerability exists in the way that the Windows Function Discovery Service handles objects in memory. An attacker who successfully exploited the vulnerability could execute code with elevated permissions.
To exploit the vulnerability, a locally authenticated attacker could run a specially crafted application.
The security update addre
nvd
CVE-2023-21701P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.219152023-02-14
CVE-2023-21701 [HIGH] CWE-126 CVE-2023-21701: Microsoft Protected Extensible Authentication Protocol (PEAP) Denial of Service Vulnerability
Microsoft Protected Extensible Authentication Protocol (PEAP) Denial of Service Vulnerability
nvd
CVE-2021-26442P3HIGHCVSS 7.8≥ 6.0.0, < 6.0.6003.212512021-10-13
CVE-2021-26442 [HIGH] CVE-2021-26442: Windows HTTP.sys Elevation of Privilege Vulnerability
Windows HTTP.sys Elevation of Privilege Vulnerability
nvd
CVE-2020-0664P3MEDIUMCVSS 6.5≥ 6.0.0, < publication2020-09-11
CVE-2020-0664 [MEDIUM] CVE-2020-0664: <p>An information disclosure vulnerability exists when Active Directory integrated DNS (ADIDNS) mish
An information disclosure vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticated attacker who successfully exploited this vulnerability would be able to read sensitive information about the target system.
To exploit this condition, an authenticated attacker would need to send a specially crafted reque
nvd
CVE-2020-16900P3HIGHCVSS 7.8≥ 6.0.0, < publication2020-10-16
CVE-2020-16900 [HIGH] CVE-2020-16900: <p>An elevation of privilege vulnerability exists when the Windows Event System improperly handles o
An elevation of privilege vulnerability exists when the Windows Event System improperly handles objects in memory.
To exploit this vulnerability, an attacker would first have to gain execution on the victim system. An attacker could then run a specially crafted application to elevate privileges.
The security update addresses the vulnerability by correcting ho
nvd
CVE-2022-21884P3HIGHCVSS 7.8≥ 6.0.6003.0, < 6.0.6003.213492022-01-11
CVE-2022-21884 [HIGH] CVE-2022-21884: Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
Local Security Authority Subsystem Service Elevation of Privilege Vulnerability
nvd
CVE-2020-0856P3MEDIUMCVSS 6.5≥ 6.0.0, < publication2020-09-11
CVE-2020-0856 [MEDIUM] CVE-2020-0856: <p>An information disclosure vulnerability exists when Active Directory integrated DNS (ADIDNS) mish
An information disclosure vulnerability exists when Active Directory integrated DNS (ADIDNS) mishandles objects in memory. An authenticated attacker who successfully exploited this vulnerability would be able to read sensitive information about the target system.
To exploit this condition, an authenticated attacker would need to send a specially crafted reque
nvd