cbcvebase.

Microsoft Windows Server 2012 R2 vulnerabilities

2,812 known vulnerabilities affecting microsoft/windows_server_2012_r2.

Total CVEs
2,812
CISA KEV
97
actively exploited
Public exploits
93
Exploited in wild
129
Severity breakdown
CRITICAL105HIGH1991MEDIUM704LOW12

Vulnerabilities

Page 16 of 141
CVE-2026-49178P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-49178 [HIGH] CWE-122 CVE-2026-49178: Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to exec Heap-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.
nvd
CVE-2018-8468P3MEDIUMCVSS 4.7PoCv(Server Core installation)2018-09-13
CVE-2018-8468 [MEDIUM] CVE-2018-8468: An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows An elevation of privilege vulnerability exists when Windows, allowing a sandbox escape, aka "Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
nvd
CVE-2022-21993P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.202692022-02-09
CVE-2022-21993 [HIGH] CVE-2022-21993: Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability Windows Services for NFS ONCRPC XDR Driver Information Disclosure Vulnerability
nvd
CVE-2023-21708P2CRITICALCVSS 9.8≥ 6.3.9600.0, < 6.3.9600.208652023-03-14
CVE-2023-21708 [CRITICAL] CWE-191 CVE-2023-21708: Remote Procedure Call Runtime Remote Code Execution Vulnerability Remote Procedure Call Runtime Remote Code Execution Vulnerability
nvd
CVE-2021-34494P3HIGHCVSS 8.8≥ 6.3.0, < 6.3.9600.200692021-07-14
CVE-2021-34494 [HIGH] CVE-2021-34494: Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2022-29129P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.203712022-05-10
CVE-2022-29129 [HIGH] CVE-2022-29129: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2022-29128P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.203712022-05-10
CVE-2022-29128 [HIGH] CVE-2022-29128: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2022-29141P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.203712022-05-10
CVE-2022-29141 [HIGH] CVE-2022-29141: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2018-8475P3HIGHCVSS 8.8v(Server Core installation)2018-09-13
CVE-2018-8475 [HIGH] CVE-2018-8475: A remote code execution vulnerability exists when Windows does not properly handle specially crafted A remote code execution vulnerability exists when Windows does not properly handle specially crafted image files, aka "Windows Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.
nvd
CVE-2025-26647P2HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.225232025-04-08
CVE-2025-26647 [HIGH] CWE-20 CVE-2025-26647: Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges ov Improper input validation in Windows Kerberos allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-42985P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.232282026-06-09
CVE-2026-42985 [HIGH] CWE-416 CVE-2026-42985: Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a netwo Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-50505P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-50505 [HIGH] CWE-416 CVE-2026-50505: Use after free in Windows Message Queuing allows an authorized attacker to execute code over a netwo Use after free in Windows Message Queuing allows an authorized attacker to execute code over a network.
nvd
CVE-2019-0736P3CRITICALCVSS 9.8≥ 6.3.0, < publication2019-08-14
CVE-2019-0736 [CRITICAL] CWE-787 CVE-2019-0736: A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially A memory corruption vulnerability exists in the Windows DHCP client when an attacker sends specially crafted DHCP responses to a client. An attacker who successfully exploited the vulnerability could run arbitrary code on the client machine. To exploit the vulnerability, an attacker could send specially crafted DHCP responses to a client. The securi
nvd
CVE-2021-36958P3HIGHCVSS 7.8≥ 6.3.0, < 6.3.9600.201202021-08-12
CVE-2021-36958 [HIGH] CVE-2021-36958: <p>A remote code execution vulnerability exists when the Windows Print Spooler service improperly pe A remote code execution vulnerability exists when the Windows Print Spooler service improperly performs privileged file operations. An attacker who successfully exploited this vulnerability could run arbitrary code with SYSTEM privileges. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
nvd
CVE-2024-30078P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.220232024-06-11
CVE-2024-30078 [HIGH] CWE-20 CVE-2024-30078: Windows Wi-Fi Driver Remote Code Execution Vulnerability Windows Wi-Fi Driver Remote Code Execution Vulnerability
nvd
CVE-2025-33070P3HIGHCVSS 8.1≥ 6.3.9600.0, < 6.3.9600.226202025-06-10
CVE-2025-33070 [HIGH] CWE-908 CVE-2025-33070: Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privile Use of uninitialized resource in Windows Netlogon allows an unauthorized attacker to elevate privileges over a network.
nvd
CVE-2024-38240P3CRITICALCVSS 9.8≥ 6.3.9600.0, < 6.3.9600.221752024-09-10
CVE-2024-38240 [CRITICAL] CWE-125 CVE-2024-38240: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
nvd
CVE-2026-49798P3CRITICALCVSS 9.3≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-49798 [CRITICAL] CWE-416 CVE-2026-49798: Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally. Use after free in Windows Kernel allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2025-26645P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.224702025-03-11
CVE-2025-26645 [HIGH] CWE-23 CVE-2025-26645: Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code ove Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-49164P3CRITICALCVSS 9.8≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-49164 [CRITICAL] CWE-122 CVE-2026-49164: Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to ex Heap-based buffer overflow in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.
nvd
← Previous16 / 141Next →
Microsoft Windows Server 2012 R2 vulnerabilities | cvebase