Microsoft Windows Server 2016 vulnerabilities

CVE-2026-54999 [HIGH] CWE-362 CVE-2026-54999: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an unauthorized attacker to execute code over an adjacent network.

CVE-2026-85905 [HIGH] CWE-122 CVE-2026-85905: Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate p Heap-based buffer overflow in Windows UI Immersive Server allows an authorized attacker to elevate privileges locally.

CVE-2026-83716 [HIGH] CWE-122 CVE-2026-83716: Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

CVE-2026-69603 [HIGH] CWE-122 CVE-2026-69603: Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally. Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

CVE-2026-50692 [HIGH] CWE-122 CVE-2026-50692: Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privil Heap-based buffer overflow in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

CVE-2018-8423 [HIGH] CWE-119 CVE-2018-8423: A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JE A remote code execution vulnerability exists in the Microsoft JET Database Engine, aka "Microsoft JET Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Wi

CVE-2026-70229 [HIGH] CWE-863 CVE-2026-70229: Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execu Incorrect authorization in Active Directory Domain Services allows an unauthorized attacker to execute code over a network.

CVE-2021-27092 [CRITICAL] CVE-2021-27092: Azure AD Web Sign-in Security Feature Bypass Vulnerability Azure AD Web Sign-in Security Feature Bypass Vulnerability

CVE-2019-0888 [HIGH] CVE-2019-0888: A remote code execution vulnerability exists in the way that ActiveX Data Objects (ADO) handle objec A remote code execution vulnerability exists in the way that ActiveX Data Objects (ADO) handle objects in memory. An attacker who successfully exploited the vulnerability could execute arbitrary code with the victim user’s privileges. An attacker could craft a website that exploits the vulnerability and then convince a victim user to visit the website. The secu

CVE-2026-100218 [HIGH] CWE-416 CVE-2026-100218: Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code ove Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

CVE-2026-83914 [HIGH] CWE-416 CVE-2026-83914: Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network. Use after free in Microsoft XML allows an unauthorized attacker to execute code over a network.

CVE-2026-70187 [HIGH] CWE-416 CVE-2026-70187: Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code ove Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.

CVE-2026-78449 [HIGH] CWE-416 CVE-2026-78449: Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to ex Use after free in Reliable Multicast Transport Driver (RMCAST) allows an unauthorized attacker to execute code over a network.

CVE-2026-69732 [HIGH] CWE-122 CVE-2026-69732: Heap-based buffer overflow in Windows Link Layer Topology Discovery Protocol allows an unauthorized Heap-based buffer overflow in Windows Link Layer Topology Discovery Protocol allows an unauthorized attacker to execute code over a network.

CVE-2026-69786 [HIGH] CWE-122 CVE-2026-69786: Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code o Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.

CVE-2026-85371 [HIGH] CWE-416 CVE-2026-85371: Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a Use after free in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.

CVE-2026-62820 [HIGH] CWE-362 CVE-2026-62820: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DNS allows an unauthorized attacker to execute code over a network.

CVE-2026-69830 [HIGH] CWE-362 CVE-2026-69830: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows DHCP Server allows an unauthorized attacker to execute code over a network.

CVE-2025-54110 [HIGH] CWE-190 CVE-2025-54110: Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges Integer overflow or wraparound in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-88174 [HIGH] CWE-362 CVE-2026-88174: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Deployment Services allows an unauthorized attacker to execute code over a network.