cbcvebase.

Microsoft Windows Server 2016 vulnerabilities

4,536 known vulnerabilities affecting microsoft/windows_server_2016.

Total CVEs
4,536
CISA KEV
116
actively exploited
Public exploits
172
Exploited in wild
176
Severity breakdown
CRITICAL135HIGH3181MEDIUM1198LOW22

Vulnerabilities

Page 41 of 227
CVE-2025-58726P3HIGHCVSS 7.5≤ 10.0.14393.8519≥ 10.0.14393.0, < 10.0.14393.85192025-10-14
CVE-2025-58726 [HIGH] CWE-284 CVE-2025-58726: Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges ov Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-20926P3HIGHCVSS 7.5fixed in 10.0.14393.8783≥ 10.0.14393.0, < 10.0.14393.87832026-01-13
CVE-2026-20926 [HIGH] CWE-362 CVE-2026-20926: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-20919P3HIGHCVSS 7.5fixed in 10.0.14393.8783≥ 10.0.14393.0, < 10.0.14393.87832026-01-13
CVE-2026-20919 [HIGH] CWE-362 CVE-2026-20919: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-20934P3HIGHCVSS 7.5fixed in 10.0.14393.8783≥ 10.0.14393.0, < 10.0.14393.87832026-01-13
CVE-2026-20934 [HIGH] CWE-362 CVE-2026-20934: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2020-0690P3CRITICALCVSS 9.8v1803v1903+1 more2020-03-12
CVE-2020-0690 [CRITICAL] CVE-2020-0690: An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, ak An elevation of privilege vulnerability exists when DirectX improperly handles objects in memory, aka 'DirectX Elevation of Privilege Vulnerability'.
nvd
CVE-2021-24091P3HIGHCVSS 8.8v20h2v1909+2 more2021-02-25
CVE-2021-24091 [HIGH] CWE-787 CVE-2021-24091: Windows Camera Codec Pack Remote Code Execution Vulnerability Windows Camera Codec Pack Remote Code Execution Vulnerability
nvd
CVE-2024-38071P3HIGHCVSS 7.5fixed in 10.0.14393.7159≥ 10.0.14393.0, < 10.0.14393.71592024-07-09
CVE-2024-38071 [HIGH] CWE-126 CVE-2024-38071: Windows Remote Desktop Licensing Service Denial of Service Vulnerability Windows Remote Desktop Licensing Service Denial of Service Vulnerability
nvd
CVE-2023-35639P3HIGHCVSS 8.8≥ 10.0.14393.0, < 10.0.14393.65292023-12-12
CVE-2023-35639 [HIGH] CWE-122 CVE-2023-35639: Microsoft ODBC Driver Remote Code Execution Vulnerability Microsoft ODBC Driver Remote Code Execution Vulnerability
nvd
CVE-2017-11899P3CRITICALCVSS 9.8v17092017-12-12
CVE-2017-11899 [CRITICAL] CVE-2017-11899: Device Guard in Windows 10 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, versio Device Guard in Windows 10 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a security feature bypass vulnerability due to the way untrusted files are handled, aka "Microsoft Windows Security Feature Bypass Vulnerability".
nvd
CVE-2018-8392P3HIGHCVSS 7.8v1709v1803+1 more2018-09-13
CVE-2018-8392 [HIGH] CVE-2018-8392: A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Serve
nvd
CVE-2024-26214P3HIGHCVSS 8.8fixed in 10.0.14393.6897≥ 10.0.14393.0, < 10.0.14393.68972024-04-09
CVE-2024-26214 [HIGH] CWE-122 CVE-2024-26214: Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability Microsoft WDAC SQL Server ODBC Driver Remote Code Execution Vulnerability
nvd
CVE-2022-30221P3HIGHCVSS 8.8v20h2≥ 10.0.14393.0, < 10.0.14393.52462022-07-12
CVE-2022-30221 [HIGH] CVE-2022-30221: Windows Graphics Component Remote Code Execution Vulnerability Windows Graphics Component Remote Code Execution Vulnerability
nvd
CVE-2018-8393P3HIGHCVSS 7.8v1709v18032018-09-13
CVE-2018-8393 [HIGH] CVE-2018-8393: A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote A buffer overflow vulnerability exists in the Microsoft JET Database Engine that could allow remote code execution on an affected system, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Serve
nvd
CVE-2023-36006P3HIGHCVSS 8.8≥ 10.0.14393.0, < 10.0.14393.65292023-12-12
CVE-2023-36006 [HIGH] CWE-121 CVE-2023-36006: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2023-36402P3HIGHCVSS 8.8≥ 10.0.14393.0, < 10.0.14393.64522023-11-14
CVE-2023-36402 [HIGH] CWE-122 CVE-2023-36402: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2023-36577P3HIGHCVSS 8.8≥ 10.0.14393.0, < 10.0.14393.63512023-10-10
CVE-2023-36577 [HIGH] CWE-122 CVE-2023-36577: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2023-28297P3HIGHCVSS 8.8≥ 10.0.14393.0, < 10.0.14393.56482023-04-11
CVE-2023-28297 [HIGH] CWE-416 CVE-2023-28297: Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege Vulnerability Windows Remote Procedure Call Service (RPCSS) Elevation of Privilege Vulnerability
nvd
CVE-2024-21367P3HIGHCVSS 8.8fixed in 10.0.14393.6709≥ 10.0.14393.0, < 10.0.14393.67092024-02-13
CVE-2024-21367 [HIGH] CWE-122 CVE-2024-21367: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-21375P3HIGHCVSS 8.8fixed in 10.0.14393.6709≥ 10.0.14393.0, < 10.0.14393.67092024-02-13
CVE-2024-21375 [HIGH] CWE-416 CVE-2024-21375: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
nvd
CVE-2024-21361P3HIGHCVSS 8.8fixed in 10.0.14393.6709≥ 10.0.14393.0, < 10.0.14393.67092024-02-13
CVE-2024-21361 [HIGH] CWE-122 CVE-2024-21361: Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
nvd
← Previous41 / 227Next →
Microsoft Windows Server 2016 vulnerabilities | cvebase