Microsoft Windows Server 2016 vulnerabilities

4,536 known vulnerabilities affecting microsoft/windows_server_2016.

Total CVEs

4,536

CISA KEV

116

actively exploited

Public exploits

172

Exploited in wild

176

Severity breakdown

CRITICAL135HIGH3181MEDIUM1198LOW22

Vulnerabilities

SortPage 197 of 227

CVE-2025-49658P4MEDIUMCVSS 5.5fixed in 10.0.14393.8246≥ 10.0.14393.0, < 10.0.14393.82462025-07-08

CVE-2025-49658 [MEDIUM] CWE-125 CVE-2025-49658: Out-of-bounds read in Windows TDX.sys allows an authorized attacker to disclose information locally. Out-of-bounds read in Windows TDX.sys allows an authorized attacker to disclose information locally.

nvd

CVE-2026-25169P4MEDIUMCVSS 5.5fixed in 10.0.14393.8957≥ 10.0.14393.0, < 10.0.14393.89572026-03-10

CVE-2026-25169 [MEDIUM] CWE-369 CVE-2026-25169: Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service local Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.

nvd

CVE-2025-59203P4MEDIUMCVSS 5.5≤ 10.0.14393.8519≥ 10.0.14393.0, < 10.0.14393.85192025-10-14

CVE-2025-59203 [MEDIUM] CWE-532 CVE-2025-59203: Insertion of sensitive information into log file in Windows StateRepository API allows an authorized Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally.

nvd

CVE-2025-59197P4MEDIUMCVSS 5.5≤ 10.0.14393.8519≥ 10.0.14393.0, < 10.0.14393.85192025-10-14

CVE-2025-59197 [MEDIUM] CWE-532 CVE-2025-59197: Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacke Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally.

nvd

CVE-2025-59253P4MEDIUMCVSS 5.5≤ 10.0.14393.8519≥ 10.0.14393.0, < 10.0.14393.85192025-10-14

CVE-2025-59253 [MEDIUM] CWE-284 CVE-2025-59253: Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.

nvd

CVE-2020-1259P4MEDIUMCVSS 4.3v1803v1903+2 more2020-06-09

CVE-2020-1259 [MEDIUM] CVE-2020-1259: A security feature bypass vulnerability exists when Windows Host Guardian Service improperly handles A security feature bypass vulnerability exists when Windows Host Guardian Service improperly handles hashes recorded and logged, aka 'Windows Host Guardian Service Security Feature Bypass Vulnerability'.

nvd

CVE-2021-28311P4MEDIUMCVSS 6.5v20h2v1909+2 more2021-04-13

CVE-2021-28311 [MEDIUM] CVE-2021-28311: Windows Application Compatibility Cache Denial of Service Vulnerability Windows Application Compatibility Cache Denial of Service Vulnerability

nvd

CVE-2025-21268P4MEDIUMCVSS 4.3fixed in 10.0.14393.7699≥ 10.0.14393.0, < 10.0.14393.76992025-01-14

CVE-2025-21268 [MEDIUM] CWE-41 CVE-2025-21268: MapUrlToZone Security Feature Bypass Vulnerability MapUrlToZone Security Feature Bypass Vulnerability

nvd

CVE-2026-20834P4MEDIUMCVSS 4.6fixed in 10.0.14393.8783≥ 10.0.14393.0, < 10.0.14393.87832026-01-13

CVE-2026-20834 [MEDIUM] CWE-36 CVE-2026-20834: Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.

nvd

CVE-2021-1696P4MEDIUMCVSS 5.5v20h2v1909+2 more2021-01-12

CVE-2021-1696 [MEDIUM] CVE-2021-1696: Windows Graphics Component Information Disclosure Vulnerability Windows Graphics Component Information Disclosure Vulnerability

nvd

CVE-2025-58717P4MEDIUMCVSS 4.3≤ 10.0.14393.8519≥ 10.0.14393.0, < 10.0.14393.85192025-10-14

CVE-2025-58717 [MEDIUM] CWE-125 CVE-2025-58717: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

nvd

CVE-2025-55700P4MEDIUMCVSS 4.3≤ 10.0.14393.8519≥ 10.0.14393.0, < 10.0.14393.85192025-10-14

CVE-2025-55700 [MEDIUM] CWE-125 CVE-2025-55700: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

nvd

CVE-2025-54107P4MEDIUMCVSS 4.3fixed in 10.0.14393.8422≥ 10.0.14393.0, < 10.0.14393.84222025-09-09

CVE-2025-54107 [MEDIUM] CWE-41 CVE-2025-54107: Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to b Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

nvd

CVE-2025-54917P4MEDIUMCVSS 4.3fixed in 10.0.14393.8422≥ 10.0.14393.0, < 10.0.14393.84222025-09-09

CVE-2025-54917 [MEDIUM] CWE-693 CVE-2025-54917: Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a sec Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

nvd

CVE-2018-8436P4MEDIUMCVSS 6.2v1803v(Server Core installation)2018-09-13

CVE-2018-8436 [MEDIUM] CWE-20 CVE-2018-8436: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fail A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8437, CVE-2018-8438.

nvd

CVE-2018-8437P4MEDIUMCVSS 6.2v18032018-09-13

CVE-2018-8437 [MEDIUM] CVE-2018-8437: A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fail A denial of service vulnerability exists when Microsoft Hyper-V Network Switch on a host server fails to properly validate input from a privileged user on a guest operating system, aka "Windows Hyper-V Denial of Service Vulnerability." This affects Windows 10, Windows 10 Servers. This CVE ID is unique from CVE-2018-8436, CVE-2018-8438.

nvd

CVE-2023-35642P4MEDIUMCVSS 6.5≥ 10.0.14393.0, < 10.0.14393.65292023-12-12

CVE-2023-35642 [MEDIUM] CWE-682 CVE-2023-35642: Internet Connection Sharing (ICS) Denial of Service Vulnerability Internet Connection Sharing (ICS) Denial of Service Vulnerability

nvd

CVE-2019-1292P4MEDIUMCVSS 4.9v1803v19032019-09-11

CVE-2019-1292 [MEDIUM] CVE-2019-1292: A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Win A denial of service vulnerability exists when Windows improperly handles objects in memory, aka 'Windows Denial of Service Vulnerability'.

nvd

CVE-2019-0928P4MEDIUMCVSS 6.2v18032019-09-11

CVE-2019-0928 [MEDIUM] CWE-20 CVE-2019-0928: A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly v A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'.

nvd

CVE-2019-1399P4MEDIUMCVSS 6.2v1803v19032019-11-12

CVE-2019-1399 [MEDIUM] CVE-2019-1399: A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly v A denial of service vulnerability exists when Microsoft Hyper-V on a host server fails to properly validate input from a privileged user on a guest operating system, aka 'Windows Hyper-V Denial of Service Vulnerability'. This CVE ID is unique from CVE-2019-0712, CVE-2019-1309, CVE-2019-1310.

nvd

← Previous197 / 227Next →