Microsoft Windows Server 2012 vulnerabilities

3,709 known vulnerabilities affecting microsoft/windows_server_2012.

Total CVEs

3,709

CISA KEV

148

actively exploited

Public exploits

269

Exploited in wild

142

Severity breakdown

CRITICAL157HIGH2452MEDIUM1048LOW52

Vulnerabilities

Page 1 of 186

CVE-2026-32183HIGHCVSS 7.8≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-32183 [HIGH] CWE-77 CVE-2026-32183: Improper neutralization of special elements used in a command ('command injection') in Windows Snipp Improper neutralization of special elements used in a command ('command injection') in Windows Snipping Tool allows an unauthorized attacker to execute code locally.

cvelistv5nvd

CVE-2026-27919HIGHCVSS 7.8≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-27919 [HIGH] CWE-822 CVE-2026-27919: Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an author Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-26177HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-26177 [HIGH] CWE-416 CVE-2026-26177: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to ele Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-32070HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-32070 [HIGH] CWE-416 CVE-2026-32070: Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate pri Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-33100HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-33100 [HIGH] CWE-416 CVE-2026-33100: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to ele Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-26152HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-26152 [HIGH] CWE-922 CVE-2026-26152: Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized att Insecure storage of sensitive information in Windows Cryptographic Services allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-32068HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-32068 [HIGH] CWE-362 CVE-2026-32068: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-32082HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-32082 [HIGH] CWE-362 CVE-2026-32082: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-33099HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-33099 [HIGH] CWE-416 CVE-2026-33099: Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to ele Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-32087HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-32087 [HIGH] CWE-122 CVE-2026-32087: Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker t Heap-based buffer overflow in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-26154HIGHCVSS 7.5≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-26154 [HIGH] CWE-20 CVE-2026-26154: Improper input validation in Windows Server Update Service allows an unauthorized attacker to perfor Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.

cvelistv5nvd

CVE-2026-27909HIGHCVSS 7.8≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-27909 [HIGH] CWE-416 CVE-2026-27909: Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privil Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-27910HIGHCVSS 7.8≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-27910 [HIGH] CWE-280 CVE-2026-27910: Improper handling of insufficient permissions or privileges in Windows Installer allows an authorize Improper handling of insufficient permissions or privileges in Windows Installer allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-32086HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-32086 [HIGH] CWE-362 CVE-2026-32086: Concurrent execution using shared resource with improper synchronization ('race condition') in Funct Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-26183HIGHCVSS 7.8≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-26183 [HIGH] CWE-284 CVE-2026-26183: Improper access control in Windows RPC API allows an authorized attacker to elevate privileges local Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-27915HIGHCVSS 7.8≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-27915 [HIGH] CWE-416 CVE-2026-27915: Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker t Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-32150HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-32150 [HIGH] CWE-362 CVE-2026-32150: Concurrent execution using shared resource with improper synchronization ('race condition') in Funct Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-32156HIGHCVSS 7.4≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-32156 [HIGH] CWE-416 CVE-2026-32156: Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an unauthorized attacker to execute code locally.

cvelistv5nvd

CVE-2026-32083HIGHCVSS 7.0≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-32083 [HIGH] CWE-362 CVE-2026-32083: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

CVE-2026-27914HIGHCVSS 7.8≥ 6.2.9200.0, < 6.2.9200.260262026-04-14

CVE-2026-27914 [HIGH] CWE-284 CVE-2026-27914: Improper access control in Microsoft Management Console allows an authorized attacker to elevate pri Improper access control in Microsoft Management Console allows an authorized attacker to elevate privileges locally.

cvelistv5nvd

1 / 186Next →