Microsoft Windows Server 2016 vulnerabilities
6,033 known vulnerabilities affecting microsoft/windows_server_2016.
Total CVEs
6,033
CISA KEV
121
actively exploited
Public exploits
174
Exploited in wild
181
Severity breakdown
CRITICAL215HIGH4237MEDIUM1559LOW22
Vulnerabilities
Page 63 of 302
CVE-2026-85368P3HIGHCVSS 7.8fixed in 10.0.14393.9612≥ 10.0.14393.0, < 10.0.14393.96122026-10-13
CVE-2026-85368 [HIGH] CWE-122 CVE-2026-85368: Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges loc
Heap-based buffer overflow in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-83767P3HIGHCVSS 7.8fixed in 10.0.14393.9612≥ 10.0.14393.0, < 10.0.14393.96122026-10-13
CVE-2026-83767 [HIGH] CWE-121 CVE-2026-83767: Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges
Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-85867P3HIGHCVSS 7.8fixed in 10.0.14393.9612≥ 10.0.14393.0, < 10.0.14393.96122026-10-13
CVE-2026-85867 [HIGH] CWE-122 CVE-2026-85867: Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker
Heap-based buffer overflow in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally.
nvd
CVE-2021-40469P3HIGHCVSS 7.2v20h2v2004+1 more2021-10-13
CVE-2021-40469 [HIGH] CVE-2021-40469: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2026-69793P3HIGHCVSS 7.5fixed in 10.0.14393.9512≥ 10.0.14393.0, < 10.0.14393.95122026-09-08
CVE-2026-69793 [HIGH] CWE-1288 CVE-2026-69793: Improper validation of consistency within input in Windows TCP/IP allows an unauthorized attacker to
Improper validation of consistency within input in Windows TCP/IP allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2026-96071P3HIGHCVSS 7.5fixed in 10.0.14393.9612≥ 10.0.14393.0, < 10.0.14393.96122026-10-13
CVE-2026-96071 [HIGH] CWE-122 CVE-2026-96071: Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a n
Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-69706P3HIGHCVSS 7.5fixed in 10.0.14393.9512≥ 10.0.14393.0, < 10.0.14393.95122026-09-08
CVE-2026-69706 [HIGH] CWE-416 CVE-2026-69706: Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network.
Use after free in Windows Win32K allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2022-24502P3MEDIUMCVSS 6.5≥ 10.0.14393.0, < 10.0.14393.50062022-03-09
CVE-2022-24502 [MEDIUM] CVE-2022-24502: Windows HTML Platforms Security Feature Bypass Vulnerability
Windows HTML Platforms Security Feature Bypass Vulnerability
nvd
CVE-2020-1508P3HIGHCVSS 8.8v1903v1909+2 more2020-09-11
CVE-2020-1508 [HIGH] CVE-2020-1508: <p>A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles
A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully exploited the vulnerability could take control of an affected system.
There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user
nvd
CVE-2020-1400P3HIGHCVSS 7.8v1903v1909+1 more2020-07-14
CVE-2020-1400 [HIGH] CWE-191 CVE-2020-1400: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-1401, CVE-2020-1407.
nvd
CVE-2026-78446P3HIGHCVSS 7.5fixed in 10.0.14393.9512≥ 10.0.14393.0, < 10.0.14393.95122026-09-08
CVE-2026-78446 [HIGH] CWE-416 CVE-2026-78446: Use after free in Windows Distributed File System (DFS) allows an authorized attacker to execute cod
Use after free in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
nvd
CVE-2026-85798P3HIGHCVSS 7.2fixed in 10.0.14393.9612≥ 10.0.14393.0, < 10.0.14393.96122026-10-13
CVE-2026-85798 [HIGH] CWE-122 CVE-2026-85798: Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to execute code over a network.
nvd
CVE-2020-1593P3HIGHCVSS 8.8v1903v1909+2 more2020-09-11
CVE-2020-1593 [HIGH] CVE-2020-1593: <p>A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles
A remote code execution vulnerability exists when Windows Media Audio Decoder improperly handles objects. An attacker who successfully exploited the vulnerability could take control of an affected system.
There are multiple ways an attacker could exploit the vulnerability, such as by convincing a user to open a specially crafted document, or by convincing a user
nvd
CVE-2019-0580P3HIGHCVSS 7.8v1709v18032019-01-08
CVE-2019-0580 [HIGH] CVE-2019-0580: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008
nvd
CVE-2019-0579P3HIGHCVSS 7.8v1709v18032019-01-08
CVE-2019-0579 [HIGH] CVE-2019-0579: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008
nvd
CVE-2019-0577P3HIGHCVSS 7.8v1709v18032019-01-08
CVE-2019-0577 [HIGH] CVE-2019-0577: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008
nvd
CVE-2022-21920P3HIGHCVSS 8.8≥ 10.0.14393.0, < 10.0.14393.48862022-01-11
CVE-2022-21920 [HIGH] CVE-2022-21920: Windows Kerberos Elevation of Privilege Vulnerability
Windows Kerberos Elevation of Privilege Vulnerability
nvd
CVE-2022-22019P3HIGHCVSS 8.8≥ 10.0.14393.0, < 10.0.14393.51252022-05-10
CVE-2022-22019 [HIGH] CVE-2022-22019: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
nvd
CVE-2022-24528P3HIGHCVSS 8.8v20h2≥ 10.0.14393.0, < 10.0.14393.50662022-04-15
CVE-2022-24528 [HIGH] CVE-2022-24528: Remote Procedure Call Runtime Remote Code Execution Vulnerability
Remote Procedure Call Runtime Remote Code Execution Vulnerability
nvd
CVE-2019-0576P3HIGHCVSS 7.8v1709v18032019-01-08
CVE-2019-0576 [HIGH] CVE-2019-0576: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka "Jet Database Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008
nvd