Microsoft Windows Server 2008 Service Pack 2 vulnerabilities
1,694 known vulnerabilities affecting microsoft/windows_server_2008_service_pack_2.
Total CVEs
1,694
CISA KEV
67
actively exploited
Public exploits
64
Exploited in wild
89
Severity breakdown
CRITICAL69HIGH1231MEDIUM391LOW3
Vulnerabilities
Page 59 of 85
CVE-2025-26676P3MEDIUMCVSS 6.5≥ 6.0.6003.0, < 6.0.6003.232202025-04-08
CVE-2025-26676 [MEDIUM] CWE-126 CVE-2025-26676: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-53134P3HIGHCVSS 7.0≥ 6.0.6003.0, < 6.0.6003.234712025-08-12
CVE-2025-53134 [HIGH] CWE-200 CVE-2025-53134: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-20831P3HIGHCVSS 7.0≥ 6.0.6003.0, < 6.0.6003.237172026-01-13
CVE-2026-20831 [HIGH] CWE-367 CVE-2026-20831: Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock a
Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-20869P3HIGHCVSS 7.0≥ 6.0.6003.0, < 6.0.6003.237172026-01-13
CVE-2026-20869 [HIGH] CWE-362 CVE-2026-20869: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-49762P3HIGHCVSS 7.0≥ 6.0.6003.0, < 6.0.6003.234712025-08-12
CVE-2025-49762 [HIGH] CWE-362 CVE-2025-49762: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-53798P3MEDIUMCVSS 6.5≥ 6.0.6003.0, < 6.0.6003.235292025-09-09
CVE-2025-53798 [MEDIUM] CWE-126 CVE-2025-53798: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-53806P3MEDIUMCVSS 6.5≥ 6.0.6003.0, < 6.0.6003.235292025-09-09
CVE-2025-53806 [MEDIUM] CWE-125 CVE-2025-53806: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-53797P3MEDIUMCVSS 6.5≥ 6.0.6003.0, < 6.0.6003.235292025-09-09
CVE-2025-53797 [MEDIUM] CWE-126 CVE-2025-53797: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-53796P3MEDIUMCVSS 6.5≥ 6.0.6003.0, < 6.0.6003.235292025-09-09
CVE-2025-53796 [MEDIUM] CWE-126 CVE-2025-53796: Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker
Buffer over-read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2023-35351P3MEDIUMCVSS 6.6≥ 6.0.6003.0, < 6.0.6003.221752023-07-11
CVE-2023-35351 [MEDIUM] CWE-416 CVE-2023-35351: Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
nvd
CVE-2023-35346P3MEDIUMCVSS 6.6≥ 6.0.6003.0, < 6.0.6003.221752023-07-11
CVE-2023-35346 [MEDIUM] CWE-591 CVE-2023-35346: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2023-35345P3MEDIUMCVSS 6.6≥ 6.0.6003.0, < 6.0.6003.221752023-07-11
CVE-2023-35345 [MEDIUM] CWE-591 CVE-2023-35345: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2023-35344P3MEDIUMCVSS 6.6≥ 6.0.6003.0, < 6.0.6003.221752023-07-11
CVE-2023-35344 [MEDIUM] CWE-591 CVE-2023-35344: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2023-35310P3MEDIUMCVSS 6.6≥ 6.0.6003.0, < 6.0.6003.221752023-07-11
CVE-2023-35310 [MEDIUM] CWE-591 CVE-2023-35310: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2022-21848P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.213492022-01-11
CVE-2022-21848 [HIGH] CVE-2022-21848: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
nvd
CVE-2021-31183P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.211672021-07-14
CVE-2021-31183 [HIGH] CVE-2021-31183: Windows TCP/IP Driver Denial of Service Vulnerability
Windows TCP/IP Driver Denial of Service Vulnerability
nvd
CVE-2022-34720P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.216662022-09-13
CVE-2022-34720 [HIGH] CVE-2022-34720: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
nvd
CVE-2022-26915P3HIGHCVSS 7.5≥ 6.0.6003.0, < 6.0.6003.214462022-04-15
CVE-2022-26915 [HIGH] CVE-2022-26915: Windows Secure Channel Denial of Service Vulnerability
Windows Secure Channel Denial of Service Vulnerability
nvd
CVE-2019-0972P3MEDIUMCVSS 6.5≥ 6.0.6003.0, < publication≥ 6.0.0, < publication2019-06-12
CVE-2019-0972 [MEDIUM] CVE-2019-0972: This security update corrects a denial of service in the Local Security Authority Subsystem Service
This security update corrects a denial of service in the Local Security Authority Subsystem Service (LSASS) caused when an authenticated attacker sends a specially crafted authentication request. A remote attacker who successfully exploited this vulnerability could cause a denial of service on the target system's LSASS service, which triggers an automatic rebo
nvd
CVE-2022-30202P3HIGHCVSS 7.0≥ 6.0.6003.0, < 6.0.6003.215692022-07-12
CVE-2022-30202 [HIGH] CVE-2022-30202: Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
nvd