cbcvebase.

Microsoft Windows Server 2012 R2 vulnerabilities

2,812 known vulnerabilities affecting microsoft/windows_server_2012_r2.

Total CVEs
2,812
CISA KEV
97
actively exploited
Public exploits
93
Exploited in wild
129
Severity breakdown
CRITICAL105HIGH1991MEDIUM704LOW12

Vulnerabilities

Page 30 of 141
CVE-2025-48817P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.226762025-07-08
CVE-2025-48817 [HIGH] CWE-23 CVE-2025-48817: Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code ove Relative path traversal in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-20820P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.229682026-01-13
CVE-2026-20820 [HIGH] CWE-122 CVE-2026-20820: Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-54916P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.227742025-09-09
CVE-2025-54916 [HIGH] CWE-121 CVE-2025-54916: Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Stack-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
nvd
CVE-2026-20856P3HIGHCVSS 8.1≥ 6.3.9600.0, < 6.3.9600.229682026-01-13
CVE-2026-20856 [HIGH] CWE-20 CVE-2026-20856: Improper input validation in Windows Server Update Service allows an unauthorized attacker to execut Improper input validation in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-42987P3HIGHCVSS 8.1≥ 6.3.9600.0, < 6.3.9600.232282026-06-09
CVE-2026-42987 [HIGH] CWE-416 CVE-2026-42987: Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a Use after free in Windows Deployment Services allows an unauthorized attacker to execute code over a network.
nvd
CVE-2025-21277P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.223712025-01-14
CVE-2025-21277 [HIGH] CWE-126 CVE-2025-21277: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
nvd
CVE-2023-21818P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.208212023-02-14
CVE-2023-21818 [HIGH] CWE-20 CVE-2023-21818: Windows Secure Channel Denial of Service Vulnerability Windows Secure Channel Denial of Service Vulnerability
nvd
CVE-2026-20921P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.229682026-01-13
CVE-2026-20921 [HIGH] CWE-362 CVE-2026-20921: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2020-17049P3HIGHCVSS 7.2≥ 6.3.0, < 6.3.9600.200692020-11-11
CVE-2020-17049 [HIGH] CWE-863 CVE-2020-17049: A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines i A security feature bypass vulnerability exists in the way Key Distribution Center (KDC) determines if a service ticket can be used for delegation via Kerberos Constrained Delegation (KCD). To exploit the vulnerability, a compromised service that is configured to use KCD could tamper with a service ticket that is not valid for delegation to force the K
nvd
CVE-2025-58726P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-58726 [HIGH] CWE-284 CVE-2025-58726: Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges ov Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-20926P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.229682026-01-13
CVE-2026-20926 [HIGH] CWE-362 CVE-2026-20926: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-20919P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.229682026-01-13
CVE-2026-20919 [HIGH] CWE-362 CVE-2026-20919: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-20934P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.229682026-01-13
CVE-2026-20934 [HIGH] CWE-362 CVE-2026-20934: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-58531P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-58531 [HIGH] CWE-362 CVE-2026-58531: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2024-38071P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.220742024-07-09
CVE-2024-38071 [HIGH] CWE-126 CVE-2024-38071: Windows Remote Desktop Licensing Service Denial of Service Vulnerability Windows Remote Desktop Licensing Service Denial of Service Vulnerability
nvd
CVE-2023-35639P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.217152023-12-12
CVE-2023-35639 [HIGH] CWE-122 CVE-2023-35639: Microsoft ODBC Driver Remote Code Execution Vulnerability Microsoft ODBC Driver Remote Code Execution Vulnerability
nvd
CVE-2018-8392P3HIGHCVSS 7.8v(Server Core installation)2018-09-13
CVE-2018-8392 [HIGH] CVE-2018-8392: A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Serve
nvd
CVE-2024-26214P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.219242024-04-09
CVE-2024-26214 [HIGH] CWE-122 CVE-2024-26214: Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability
nvd
CVE-2022-30221P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.204782022-07-12
CVE-2022-30221 [HIGH] CVE-2022-30221: Windows Graphics Component Remote Code Execution Vulnerability Windows Graphics Component Remote Code Execution Vulnerability
nvd
CVE-2023-36006P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.217152023-12-12
CVE-2023-36006 [HIGH] CWE-121 CVE-2023-36006: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
nvd
← Previous30 / 141Next →
Microsoft Windows Server 2012 R2 vulnerabilities | cvebase