Microsoft Windows Server 2012 R2 vulnerabilities

2,572 known vulnerabilities affecting microsoft/windows_server_2012_r2.

Total CVEs
2,572
CISA KEV
96
actively exploited
Public exploits
54
Exploited in wild
85
Severity breakdown
CRITICAL85HIGH1805MEDIUM672LOW10

Vulnerabilities

Page 9 of 129
CVE-2025-60703HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-60703 [HIGH] CWE-822 CVE-2025-60703: Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate pri Untrusted pointer dereference in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-60720HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-60720 [HIGH] CWE-126 CVE-2025-60720: Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally. Buffer over-read in Windows TDX.sys allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-60719HIGHCVSS 7.0≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-60719 [HIGH] CWE-822 CVE-2025-60719: Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-62452HIGHCVSS 8.0≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-62452 [HIGH] CWE-122 CVE-2025-62452: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
cvelistv5nvd
CVE-2025-60714HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-60714 [HIGH] CWE-122 CVE-2025-60714: Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally. Heap-based buffer overflow in Windows OLE allows an unauthorized attacker to execute code locally.
cvelistv5nvd
CVE-2025-59512HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-59512 [HIGH] CWE-284 CVE-2025-59512: Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attac Improper access control in Customer Experience Improvement Program (CEIP) allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-60709HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-60709 [HIGH] CWE-125 CVE-2025-60709: Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate Out-of-bounds read in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-60715HIGHCVSS 8.0≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-60715 [HIGH] CWE-122 CVE-2025-60715: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
cvelistv5nvd
CVE-2025-60704HIGHCVSS 7.5≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-60704 [HIGH] CWE-325 CVE-2025-60704: Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
cvelistv5nvd
CVE-2025-59510MEDIUMCVSS 5.5≥ 6.3.9600.0, < 6.3.9600.228692025-11-11
CVE-2025-59510 [MEDIUM] CWE-59 CVE-2025-59510: Improper link resolution before file access ('link following') in Windows Routing and Remote Access Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to deny service locally.
cvelistv5nvd
CVE-2025-59287CRITICALCVSS 9.8KEVPoC≥ 6.3.9600.0, < 6.3.9600.228262025-10-14
CVE-2025-59287 [CRITICAL] CWE-502 CVE-2025-59287: Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker t Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
cvelistv5nvd
CVE-2025-58730HIGHCVSS 7.0≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-58730 [HIGH] CWE-416 CVE-2025-58730: Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
cvelistv5nvd
CVE-2025-58725HIGHCVSS 7.0≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-58725 [HIGH] CWE-122 CVE-2025-58725: Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locall Heap-based buffer overflow in Windows COM allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-59278HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-59278 [HIGH] CWE-1287 CVE-2025-59278: Improper validation of specified type of input in Windows Authentication Methods allows an authorize Improper validation of specified type of input in Windows Authentication Methods allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-55692HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-55692 [HIGH] CWE-20 CVE-2025-55692: Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privil Improper input validation in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-59230HIGHCVSS 7.8KEV≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-59230 [HIGH] CWE-284 CVE-2025-59230: Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-25004HIGHCVSS 7.3≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-25004 [HIGH] CWE-284 CVE-2025-25004: Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges Improper access control in Microsoft PowerShell allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-59202HIGHCVSS 7.0≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-59202 [HIGH] CWE-416 CVE-2025-59202: Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privilege Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-55701HIGHCVSS 7.8≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-55701 [HIGH] CWE-1287 CVE-2025-55701: Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to Improper validation of specified type of input in Microsoft Windows allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-24990HIGHCVSS 7.8KEV≥ 6.3.9600.0, < 6.3.9600.228242025-10-14
CVE-2025-24990 [HIGH] CWE-822 CVE-2025-24990: Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver has been removed in the October cumulative update. Fax modem hardware dependent on this specific driver will no longer work on Window
cvelistv5nvd
← Previous9 / 129Next →