cbcvebase.

Microsoft Windows Server 2016 vulnerabilities

4,536 known vulnerabilities affecting microsoft/windows_server_2016.

Total CVEs
4,536
CISA KEV
116
actively exploited
Public exploits
172
Exploited in wild
175
Severity breakdown
CRITICAL135HIGH3181MEDIUM1198LOW22

Vulnerabilities

Page 17 of 227
CVE-2023-23415P2CRITICALCVSS 9.8≥ 10.0.14393.0, < 10.0.14393.57862023-03-14
CVE-2023-23415 [CRITICAL] CWE-122 CVE-2023-23415: Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability
nvd
CVE-2024-43532P2HIGHCVSS 8.8fixed in 10.0.14393.7428≥ 10.0.14393.0, < 10.0.14393.74282024-10-08
CVE-2024-43532 [HIGH] CWE-636 CVE-2024-43532: Remote Registry Service Elevation of Privilege Vulnerability Remote Registry Service Elevation of Privilege Vulnerability
nvd
CVE-2022-38044P3HIGHCVSS 7.8≥ 10.0.14393.0, < 10.0.14393.54272022-10-11
CVE-2022-38044 [HIGH] CVE-2022-38044: Windows CD-ROM File System Driver Remote Code Execution Vulnerability Windows CD-ROM File System Driver Remote Code Execution Vulnerability
nvd
CVE-2018-8495P3HIGHCVSS 7.5v1709v1803+1 more2018-10-10
CVE-2018-8495 [HIGH] CWE-22 CVE-2018-8495: A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Window A remote code execution vulnerability exists when Windows Shell improperly handles URIs, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.
nvd
CVE-2019-0853P2HIGHCVSS 8.8v1709v18032019-04-09
CVE-2019-0853 [HIGH] CWE-824 CVE-2019-0853: A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface ( A remote code execution vulnerability exists in the way that the Windows Graphics Device Interface (GDI) handles objects in the memory, aka 'GDI+ Remote Code Execution Vulnerability'.
nvd
CVE-2026-49181P2CRITICALCVSS 9.8fixed in 10.0.14393.9339≥ 10.0.14393.0, < 10.0.14393.93392026-07-14
CVE-2026-49181 [CRITICAL] CWE-191 CVE-2026-49181: Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to ele Integer underflow (wrap or wraparound) in Windows DHCP Client allows an unauthorized attacker to elevate privileges over a network.
nvd
CVE-2022-21849P2CRITICALCVSS 9.8≥ 10.0.14393.0, < 10.0.14393.48862022-01-11
CVE-2022-21849 [CRITICAL] CVE-2022-21849: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability
nvd
CVE-2019-0603P3HIGHCVSS 7.5v18032019-04-08
CVE-2019-0603 [HIGH] CVE-2019-0603: A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with elevated permissions on a target system. To exploit the vulnerability, an attacker could create a specially crafted request, causing Windows to
nvd
CVE-2022-22012P2CRITICALCVSS 9.8≥ 10.0.14393.0, < 10.0.14393.51252022-05-10
CVE-2022-22012 [CRITICAL] CVE-2022-22012: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2022-29130P2CRITICALCVSS 9.8≥ 10.0.14393.0, < 10.0.14393.51252022-05-10
CVE-2022-29130 [CRITICAL] CVE-2022-29130: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2023-35349P2CRITICALCVSS 9.8≥ 10.0.14393.0, < 10.0.14393.63512023-10-10
CVE-2023-35349 [CRITICAL] CWE-20 CVE-2023-35349: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
nvd
CVE-2021-34458P2CRITICALCVSS 9.9v20h2v2004+1 more2021-07-16
CVE-2021-34458 [CRITICAL] CVE-2021-34458: Windows Kernel Remote Code Execution Vulnerability Windows Kernel Remote Code Execution Vulnerability
nvd
CVE-2024-20674P2HIGHCVSS 8.8≥ 10.0.14393.0, < 10.0.14393.66142024-01-09
CVE-2024-20674 [HIGH] CWE-305 CVE-2024-20674: Windows Kerberos Security Feature Bypass Vulnerability Windows Kerberos Security Feature Bypass Vulnerability
nvd
CVE-2021-34450P2CRITICALCVSS 9.9v20h2v20042021-07-16
CVE-2021-34450 [CRITICAL] CVE-2021-34450: Windows Hyper-V Remote Code Execution Vulnerability Windows Hyper-V Remote Code Execution Vulnerability
nvd
CVE-2024-38074P2CRITICALCVSS 9.8fixed in 10.0.14393.7159≥ 10.0.14393.0, < 10.0.14393.71592024-07-09
CVE-2024-38074 [CRITICAL] CWE-191 CVE-2024-38074: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
nvd
CVE-2024-38076P2CRITICALCVSS 9.8fixed in 10.0.14393.7159≥ 10.0.14393.0, < 10.0.14393.71592024-07-09
CVE-2024-38076 [CRITICAL] CWE-122 CVE-2024-38076: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
nvd
CVE-2025-29962P2HIGHCVSS 8.8fixed in 10.0.14393.8066≥ 10.0.14393.0, < 10.0.14393.80662025-05-13
CVE-2025-29962 [HIGH] CWE-122 CVE-2025-29962: Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a n Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
nvd
CVE-2020-1436P2HIGHCVSS 8.8v1903v1909+1 more2020-07-14
CVE-2020-1436 [HIGH] CWE-787 CVE-2020-1436: A remote code execution vulnerability exists when the Windows font library improperly handles specia A remote code execution vulnerability exists when the Windows font library improperly handles specially crafted fonts.For all systems except Windows 10, an attacker who successfully exploited the vulnerability could execute code remotely, aka 'Windows Font Library Remote Code Execution Vulnerability'.
nvd
CVE-2025-33071P2HIGHCVSS 8.1fixed in 10.0.14393.8148≥ 10.0.14393.0, < 10.0.14393.81482025-06-10
CVE-2025-33071 [HIGH] CWE-416 CVE-2025-33071: Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code Use after free in Windows KDC Proxy Service (KPSSVC) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-50439P2CRITICALCVSS 9.8fixed in 10.0.14393.9339≥ 10.0.14393.0, < 10.0.14393.93392026-07-14
CVE-2026-50439 [CRITICAL] CWE-416 CVE-2026-50439: Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute Use after free in Microsoft Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
nvd
← Previous17 / 227Next →
Microsoft Windows Server 2016 vulnerabilities | cvebase