Microsoft Windows Server 2012 R2 vulnerabilities

4,055 known vulnerabilities affecting microsoft/windows_server_2012_r2.

Total CVEs

4,055

CISA KEV

101

actively exploited

Public exploits

Exploited in wild

135

Severity breakdown

CRITICAL182HIGH2840MEDIUM1021LOW12

Vulnerabilities

SortPage 41 of 203

CVE-2026-50683P3HIGHCVSS 8.0≥ 6.3.9600.0, < 6.3.9600.232912026-07-14

CVE-2026-50683 [HIGH] CWE-122 CVE-2026-50683: Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privilege Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to elevate privileges over an adjacent network.

nvd

CVE-2025-21204P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.225232025-04-08

CVE-2025-21204 [HIGH] CWE-59 CVE-2025-21204: Improper link resolution before file access ('link following') in Windows Update Stack allows an aut Improper link resolution before file access ('link following') in Windows Update Stack allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-20921P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.229682026-01-13

CVE-2026-20921 [HIGH] CWE-362 CVE-2026-20921: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

nvd

CVE-2026-20926P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.229682026-01-13

CVE-2026-20926 [HIGH] CWE-362 CVE-2026-20926: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

nvd

CVE-2026-20919P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.229682026-01-13

CVE-2026-20919 [HIGH] CWE-362 CVE-2026-20919: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

nvd

CVE-2026-20848P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.229682026-01-13

CVE-2026-20848 [HIGH] CWE-362 CVE-2026-20848: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

nvd

CVE-2026-20934P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.229682026-01-13

CVE-2026-20934 [HIGH] CWE-362 CVE-2026-20934: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

nvd

CVE-2026-69539P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.233982026-09-08

CVE-2026-69539 [HIGH] CWE-416 CVE-2026-69539: Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over Use after free in Windows Remote Desktop Services allows an authorized attacker to execute code over a network.

nvd

CVE-2026-69852P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.233982026-09-08

CVE-2026-69852 [HIGH] CWE-122 CVE-2026-69852: Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an Remote Code Execution in Windows Routing and Remote Access Service (RRAS) allows attacker to gain an unauthorized access to victim's machine

nvd

CVE-2026-58608P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.232912026-07-14

CVE-2026-58608 [HIGH] CWE-362 CVE-2026-58608: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Print Spooler Components allows an authorized attacker to execute code over a network.

nvd

CVE-2020-1509P3HIGHCVSS 8.8≥ 6.3.0, < publication2020-08-17

CVE-2020-1509 [HIGH] CVE-2020-1509: An elevation of privilege vulnerability exists in the Local Security Authority Subsystem Service (LS An elevation of privilege vulnerability exists in the Local Security Authority Subsystem Service (LSASS) when an authenticated attacker sends a specially crafted authentication request. A remote attacker who successfully exploited this vulnerability could cause an elevation of privilege on the target system's LSASS service. The security update addresses the vul

nvd

CVE-2022-21851P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.202462022-01-11

CVE-2022-21851 [HIGH] CVE-2022-21851: Remote Desktop Client Remote Code Execution Vulnerability Remote Desktop Client Remote Code Execution Vulnerability

nvd

CVE-2022-21850P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.202462022-01-11

CVE-2022-21850 [HIGH] CVE-2022-21850: Remote Desktop Client Remote Code Execution Vulnerability Remote Desktop Client Remote Code Execution Vulnerability

nvd

CVE-2024-38071P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.220742024-07-09

CVE-2024-38071 [HIGH] CWE-126 CVE-2024-38071: Windows Remote Desktop Licensing Service Denial of Service Vulnerability Windows Remote Desktop Licensing Service Denial of Service Vulnerability

nvd

CVE-2022-30153P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.204022022-06-15

CVE-2022-30153 [HIGH] CVE-2022-30153: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

nvd

CVE-2022-30161P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.204022022-06-15

CVE-2022-30161 [HIGH] CVE-2022-30161: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

nvd

CVE-2022-29139P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.203712022-05-10

CVE-2022-29139 [HIGH] CVE-2022-29139: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

nvd

CVE-2023-35639P3HIGHCVSS 8.8≥ 6.3.9600.0, < 6.3.9600.217152023-12-12

CVE-2023-35639 [HIGH] CWE-122 CVE-2023-35639: Microsoft ODBC Driver Remote Code Execution Vulnerability Microsoft ODBC Driver Remote Code Execution Vulnerability

nvd

CVE-2018-8392P3HIGHCVSS 7.8v(Server Core installation)2018-09-13

CVE-2018-8392 [HIGH] CVE-2018-8392: A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Serve

nvd

CVE-2026-20872P3MEDIUMCVSS 6.5≥ 6.3.9600.0, < 6.3.9600.229682026-01-13

CVE-2026-20872 [MEDIUM] CWE-73 CVE-2026-20872: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spo External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

nvd

← Previous41 / 203Next →