Microsoft Windows Server 2012 R2 vulnerabilities
4,050 known vulnerabilities affecting microsoft/windows_server_2012_r2.
Total CVEs
4,050
CISA KEV
101
actively exploited
Public exploits
96
Exploited in wild
135
Severity breakdown
CRITICAL182HIGH2836MEDIUM1020LOW12
Vulnerabilities
Page 79 of 203
CVE-2025-27469P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.225232025-04-08
CVE-2025-27469 [HIGH] CWE-400 CVE-2025-27469: Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an
Uncontrolled resource consumption in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.
nvd
CVE-2022-30149P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.204022022-06-15
CVE-2022-30149 [HIGH] CVE-2022-30149: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2022-30143P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.204022022-06-15
CVE-2022-30143 [HIGH] CVE-2022-30143: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2022-30146P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.204022022-06-15
CVE-2022-30146 [HIGH] CVE-2022-30146: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2022-30140P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.204022022-06-15
CVE-2022-30140 [HIGH] CVE-2022-30140: Windows iSCSI Discovery Service Remote Code Execution Vulnerability
Windows iSCSI Discovery Service Remote Code Execution Vulnerability
nvd
CVE-2024-38061P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.220742024-07-09
CVE-2024-38061 [HIGH] CWE-284 CVE-2024-38061: DCOM Remote Cross-Session Activation Elevation of Privilege Vulnerability
DCOM Remote Cross-Session Activation Elevation of Privilege Vulnerability
nvd
CVE-2024-30015P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.219722024-05-14
CVE-2024-30015 [HIGH] CWE-197 CVE-2024-30015: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
nvd
CVE-2024-30029P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.219722024-05-14
CVE-2024-30029 [HIGH] CWE-197 CVE-2024-30029: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
nvd
CVE-2024-30014P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.219722024-05-14
CVE-2024-30014 [HIGH] CWE-197 CVE-2024-30014: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
nvd
CVE-2026-20846P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.230222026-02-10
CVE-2026-20846 [HIGH] CWE-126 CVE-2026-20846: Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.
Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-60714P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-60714 [HIGH] CWE-122 CVE-2025-60714: Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally.
Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-83665P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.234702026-10-13
CVE-2026-83665 [HIGH] CWE-476 CVE-2026-83665: Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over
Null pointer dereference in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-83635P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.234702026-10-13
CVE-2026-83635 [HIGH] CWE-125 CVE-2026-83635: Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
Out-of-bounds read in DNS Server allows an unauthorized attacker to deny service over a network.
nvd
CVE-2018-0965P3HIGHCVSS 8.4v(Server Core installation)2018-09-13
CVE-2018-0965 [HIGH] CWE-20 CVE-2018-0965: A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly
A remote code execution vulnerability exists when Windows Hyper-V on a host server fails to properly validate input from an authenticated user on a guest operating system, aka "Windows Hyper-V Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8439.
nvd
CVE-2025-50173P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.227252025-08-12
CVE-2025-50173 [HIGH] CWE-1390 CVE-2025-50173: Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally
Weak authentication in Windows Installer allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-70133P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.234702026-10-13
CVE-2026-70133 [HIGH] CWE-770 CVE-2026-70133: Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized at
Allocation of resources without limits or throttling in Windows SMB Server allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-83647P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.234702026-10-13
CVE-2026-83647 [HIGH] CWE-125 CVE-2026-83647: Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny servi
Out-of-bounds read in Active Directory Domain Services allows an unauthorized attacker to deny service over a network.
nvd
CVE-2022-24474P3HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.203372022-04-15
CVE-2022-24474 [HIGH] CVE-2022-24474: Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability
nvd
CVE-2026-50328P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.232912026-07-14
CVE-2026-50328 [HIGH] CWE-20 CVE-2026-50328: Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampe
Uncaught exception in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.
nvd
CVE-2026-83645P3HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.234702026-10-13
CVE-2026-83645 [HIGH] CWE-770 CVE-2026-83645: Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS)
Allocation of resources without limits or throttling in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
nvd