Microsoft Windows Server 2012 R2 vulnerabilities
2,812 known vulnerabilities affecting microsoft/windows_server_2012_r2.
Total CVEs
2,812
CISA KEV
97
actively exploited
Public exploits
93
Exploited in wild
129
Severity breakdown
CRITICAL105HIGH1991MEDIUM704LOW12
Vulnerabilities
Page 60 of 141
CVE-2026-25165P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.230742026-03-10
CVE-2026-25165 [HIGH] CWE-476 CVE-2026-25165: Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate pr
Null pointer dereference in Windows Performance Counters allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-47976P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.226762025-07-08
CVE-2025-47976 [HIGH] CWE-416 CVE-2025-47976: Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally.
Use after free in Windows SSDP Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-55701P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-55701 [HIGH] CWE-1287 CVE-2025-55701: Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to
Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50496P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-50496 [HIGH] CWE-125 CVE-2026-50496: Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose
Out-of-bounds read in Windows Network Policy Server SNMP allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-49660P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.226762025-07-08
CVE-2025-49660 [HIGH] CWE-416 CVE-2025-49660: Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
Use after free in Windows Event Tracing allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-23672P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.230742026-03-10
CVE-2026-23672 [HIGH] CWE-125 CVE-2026-23672: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
nvd
CVE-2026-25174P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.230742026-03-10
CVE-2026-25174 [HIGH] CWE-125 CVE-2026-25174: Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate pr
Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50697P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-50697 [HIGH] CWE-200 CVE-2026-50697: Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver
Exposure of sensitive information to an unauthorized actor in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2024-26248P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.219242024-04-09
CVE-2024-26248 [HIGH] CWE-303 CVE-2024-26248: Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
nvd
CVE-2025-54895P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.227742025-09-09
CVE-2025-54895 [HIGH] CWE-190 CVE-2025-54895: Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker
Integer overflow or wraparound in Windows SPNEGO Extended Negotiation allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50498P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-50498 [HIGH] CWE-125 CVE-2026-50498: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
nvd
CVE-2026-49790P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-49790 [HIGH] CWE-122 CVE-2026-49790: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
nvd
CVE-2026-56176P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-56176 [HIGH] CWE-125 CVE-2026-56176: Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges loca
Out-of-bounds read in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-55004P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-55004 [HIGH] CWE-415 CVE-2026-55004: Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally
Double free in Microsoft Printer Drivers allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50667P3HIGHCVSS 7.0≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-50667 [HIGH] CWE-362 CVE-2026-50667: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows NTFS allows an authorized attacker to elevate privileges locally.
nvd
CVE-2023-28254P3HIGHCVSS 7.2≥ 6.3.9600.0, < 6.3.9600.209192023-04-11
CVE-2023-28254 [HIGH] CWE-122 CVE-2023-28254: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2023-24932MEDIUMCVSS 6.7Exploited≥ 6.3.9600.0, < 6.3.9600.226762023-05-09
CVE-2023-24932 [MEDIUM] Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
Secure Boot Security Feature Bypass Vulnerability
cvelistv5
CVE-2023-23400P3HIGHCVSS 7.2≥ 6.3.9600.0, < 6.3.9600.208652023-03-14
CVE-2023-23400 [HIGH] CWE-122 CVE-2023-23400: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2019-0906P3HIGHCVSS 7.8≥ 6.3.9600.0, < publication2019-06-12
CVE-2019-0906 [HIGH] CWE-129 CVE-2019-0906: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.
An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.
The update addresses the vul
nvd
CVE-2020-1562P3HIGHCVSS 7.8≥ 6.3.0, < publication2020-08-17
CVE-2020-1562 [HIGH] CVE-2020-1562: A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle ob
A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code on a target system.
To exploit the vulnerability, a user would have to open a specially crafted file.
The security update addresses the vulnerability by correct
nvd