Microsoft Windows Server 2016 vulnerabilities
6,033 known vulnerabilities affecting microsoft/windows_server_2016.
Total CVEs
6,033
CISA KEV
121
actively exploited
Public exploits
174
Exploited in wild
181
Severity breakdown
CRITICAL215HIGH4237MEDIUM1559LOW22
Vulnerabilities
Page 27 of 302
CVE-2024-43611P2HIGHCVSS 8.8fixed in 10.0.14393.7428≥ 10.0.14393.0, < 10.0.14393.74282024-10-08
CVE-2024-43611 [HIGH] CWE-20 CVE-2024-43611: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
nvd
CVE-2024-49080P2HIGHCVSS 8.8fixed in 10.0.14393.7606≥ 10.0.14393.0, < 10.0.14393.76062024-12-12
CVE-2024-49080 [HIGH] CWE-122 CVE-2024-49080: Windows IP Routing Management Snapin Remote Code Execution Vulnerability
Windows IP Routing Management Snapin Remote Code Execution Vulnerability
nvd
CVE-2024-43593P2HIGHCVSS 8.8fixed in 10.0.14393.7428≥ 10.0.14393.0, < 10.0.14393.74282024-10-08
CVE-2024-43593 [HIGH] CWE-20 CVE-2024-43593: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
nvd
CVE-2024-43592P2HIGHCVSS 8.8fixed in 10.0.14393.7428≥ 10.0.14393.0, < 10.0.14393.74282024-10-08
CVE-2024-43592 [HIGH] CWE-20 CVE-2024-43592: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
nvd
CVE-2025-21376P3HIGHCVSS 8.1fixed in 10.0.14393.7785≥ 10.0.14393.0, < 10.0.14393.77852025-02-11
CVE-2025-21376 [HIGH] CWE-122 CVE-2025-21376: Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability
nvd
CVE-2020-1074P3HIGHCVSS 7.8v1903v1909+2 more2020-09-11
CVE-2020-1074 [HIGH] CVE-2020-1074: <p>A remote code execution vulnerability exists when the Windows Jet Database Engine improperly hand
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory. An attacker who successfully exploited this vulnerability could execute arbitrary code on a victim system.
An attacker could exploit this vulnerability by enticing a victim to open a specially crafted file.
The update addresses the vulnerabili
nvd
CVE-2026-88159P2HIGHCVSS 8.8fixed in 10.0.14393.9612≥ 10.0.14393.0, < 10.0.14393.96122026-10-13
CVE-2026-88159 [HIGH] CWE-125 CVE-2026-88159: Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized atta
Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2020-0662P3HIGHCVSS 8.8v1803v1903+1 more2020-02-11
CVE-2020-0662 [HIGH] CVE-2020-0662: A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka
A remote code execution vulnerability exists in the way that Windows handles objects in memory, aka 'Windows Remote Code Execution Vulnerability'.
nvd
CVE-2023-28220P3HIGHCVSS 8.1≥ 10.0.14393.0, < 10.0.14393.58502023-04-11
CVE-2023-28220 [HIGH] CWE-591 CVE-2023-28220: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
nvd
CVE-2023-28219P3HIGHCVSS 8.1≥ 10.0.14393.0, < 10.0.14393.58502023-04-11
CVE-2023-28219 [HIGH] CWE-591 CVE-2023-28219: Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
Layer 2 Tunneling Protocol Remote Code Execution Vulnerability
nvd
CVE-2026-83889P2HIGHCVSS 8.8fixed in 10.0.14393.9612≥ 10.0.14393.0, < 10.0.14393.96122026-10-13
CVE-2026-83889 [HIGH] CWE-763 CVE-2026-83889: Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code
Release of invalid pointer or reference in DNS Server allows an authorized attacker to execute code over a network.
nvd
CVE-2026-23669P2HIGHCVSS 8.8fixed in 10.0.14393.8957≥ 10.0.14393.0, < 10.0.14393.89572026-03-10
CVE-2026-23669 [HIGH] CWE-416 CVE-2026-23669: Use after free in RPC Runtime allows an authorized attacker to execute code over a network.
Use after free in RPC Runtime allows an authorized attacker to execute code over a network.
nvd
CVE-2026-62784P2HIGHCVSS 8.8fixed in 10.0.14393.9418≥ 10.0.14393.0, < 10.0.14393.94182026-08-11
CVE-2026-62784 [HIGH] CWE-122 CVE-2026-62784: Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorize
Heap-based buffer overflow in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to execute code over a network.
nvd
CVE-2026-88165P2HIGHCVSS 8.8fixed in 10.0.14393.9612≥ 10.0.14393.0, < 10.0.14393.96122026-10-13
CVE-2026-88165 [HIGH] CWE-787 CVE-2026-88165: Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute cod
Out-of-bounds write in Active Directory Domain Services allows an authorized attacker to execute code over a network.
nvd
CVE-2026-54121P2HIGHCVSS 8.8fixed in 10.0.14393.9339≥ 10.0.14393.0, < 10.0.14393.93392026-07-14
CVE-2026-54121 [HIGH] CWE-285 CVE-2026-54121: Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacke
Improper authorization in Active Directory Certificate Services (AD CS) allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-50369P2HIGHCVSS 8.8fixed in 10.0.14393.9339≥ 10.0.14393.0, < 10.0.14393.93392026-07-14
CVE-2026-50369 [HIGH] CWE-362 CVE-2026-50369: Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privilege
Use after free in Windows Remote Desktop Services allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2024-43454P3HIGHCVSS 7.1fixed in 10.0.14393.7336≥ 10.0.14393.0, < 10.0.14393.73362024-09-10
CVE-2024-43454 [HIGH] CWE-23 CVE-2024-43454: Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
nvd
CVE-2021-33757P2CRITICALCVSS 9.8v20h2v2004+1 more2021-07-14
CVE-2021-33757 [CRITICAL] CVE-2021-33757: Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
nvd
CVE-2021-1722P2CRITICALCVSS 9.8v20h2v1909+2 more2021-02-25
CVE-2021-1722 [CRITICAL] CVE-2021-1722: Windows Fax Service Remote Code Execution Vulnerability
Windows Fax Service Remote Code Execution Vulnerability
nvd
CVE-2022-35744P2CRITICALCVSS 9.8≥ 10.0.14393.0, < 10.0.14393.52912023-05-31
CVE-2022-35744 [CRITICAL] CVE-2022-35744: Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability
Windows Point-to-Point Protocol (PPP) Remote Code Execution Vulnerability
nvd