Microsoft Windows Server 2012 vulnerabilities

CVE-2021-41377 [HIGH] CWE-269 CVE-2021-41377: Windows Fast FAT File System Driver Elevation of Privilege Vulnerability Windows Fast FAT File System Driver Elevation of Privilege Vulnerability

CVE-2023-21754 [HIGH] CWE-190 CVE-2023-21754: Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Elevation of Privilege Vulnerability

CVE-2025-54894 [HIGH] CWE-122 CVE-2025-54894: Local Security Authority Subsystem Service Elevation of Privilege Vulnerability Local Security Authority Subsystem Service Elevation of Privilege Vulnerability

CVE-2026-20816 [HIGH] CWE-367 CVE-2026-20816: Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2024-30031 [HIGH] CWE-416 CVE-2024-30031: Windows CNG Key Isolation Service Elevation of Privilege Vulnerability Windows CNG Key Isolation Service Elevation of Privilege Vulnerability

CVE-2015-2361 [HIGH] CWE-119 CVE-2015-2361: Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 does not properly initialize guest OS sy Hyper-V in Microsoft Windows 8.1 and Windows Server 2012 R2 does not properly initialize guest OS system data structures, which allows guest OS users to execute arbitrary code on the host OS or cause a denial of service (buffer overflow) by leveraging guest OS privileges, aka "Hyper-V Buffer Overflow Vulnerability."

CVE-2017-11927 [MEDIUM] CWE-200 CVE-2017-11927: Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allow an information vulnerability due to the way the Windows its:// protocol handler determines the zone of a request, aka "Microsoft Windows Informat

CVE-2023-28236 [HIGH] CWE-591 CVE-2023-28236: Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Elevation of Privilege Vulnerability

CVE-2015-2362 [HIGH] CWE-254 CVE-2015-2362: Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1, and Windows Server Hyper-V in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 does not properly initialize guest OS system data structures, which allows guest OS users to execute arbitrary code on the host OS by leveraging guest OS privileges, aka "Hyper-V System Data Structure Vulnerability."

CVE-2024-49129 [HIGH] CWE-400 CVE-2024-49129: Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability

CVE-2024-26232 [HIGH] CWE-843 CVE-2024-26232: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

CVE-2026-40414 [HIGH] CWE-476 CVE-2026-40414: Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over an a Null pointer dereference in Windows TCP/IP allows an unauthorized attacker to deny service over an adjacent network.

CVE-2025-50159 [HIGH] CWE-416 CVE-2025-50159: Use after free in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an authorized attacker Use after free in Remote Access Point-to-Point Protocol (PPP) EAP-TLS allows an authorized attacker to elevate privileges locally.

CVE-2025-25004 [HIGH] CWE-284 CVE-2025-25004: Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.

CVE-2026-26151 [HIGH] CWE-357 CVE-2026-26151: Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized att Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-69305 [HIGH] CWE-416 CVE-2026-69305: Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privil Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges over a network.

CVE-2026-21253 [HIGH] CWE-416 CVE-2026-21253: Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally. Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally.

CVE-2014-0255 [MEDIUM] CWE-20 CVE-2014-0255: Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allow remote attackers to c Microsoft Windows Server 2008 SP2 and R2 SP1 and Server 2012 Gold and R2 allow remote attackers to cause a denial of service (iSCSI service outage) by sending many crafted packets, aka "iSCSI Target Remote Denial of Service Vulnerability."

CVE-2026-47288 [HIGH] CWE-190 CVE-2026-47288: Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code ove Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network.

CVE-2020-0660 [HIGH] CVE-2020-0660: A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects A denial of service vulnerability exists in Remote Desktop Protocol (RDP) when an attacker connects to the target system using RDP and sends specially crafted requests, aka 'Windows Remote Desktop Protocol (RDP) Denial of Service Vulnerability'.