Microsoft Windows Server 2016 vulnerabilities
6,033 known vulnerabilities affecting microsoft/windows_server_2016.
Total CVEs
6,033
CISA KEV
121
actively exploited
Public exploits
174
Exploited in wild
181
Severity breakdown
CRITICAL215HIGH4237MEDIUM1559LOW22
Vulnerabilities
Page 66 of 302
CVE-2024-49126P3HIGHCVSS 8.1fixed in 10.0.14393.7606≥ 10.0.14393.0, < 10.0.14393.76062024-12-12
CVE-2024-49126 [HIGH] CWE-416 CVE-2024-49126: Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
Windows Local Security Authority Subsystem Service (LSASS) Remote Code Execution Vulnerability
nvd
CVE-2026-42905P3HIGHCVSS 7.8fixed in 10.0.14393.9234≥ 10.0.14393.0, < 10.0.14393.92342026-06-09
CVE-2026-42905 [HIGH] CWE-416 CVE-2026-42905: Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges local
Use after free in Windows DWM Core Library allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-27487P3HIGHCVSS 8.0fixed in 10.0.14393.7969≥ 10.0.14393.0, < 10.0.14393.79692025-04-08
CVE-2025-27487 [HIGH] CWE-122 CVE-2025-27487: Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code ov
Heap-based buffer overflow in Remote Desktop Client allows an authorized attacker to execute code over a network.
nvd
CVE-2025-26671P3HIGHCVSS 8.1fixed in 10.0.14393.7969≥ 10.0.14393.0, < 10.0.14393.79692025-04-08
CVE-2025-26671 [HIGH] CWE-416 CVE-2025-26671: Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code ov
Use after free in Windows Remote Desktop Services allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-56189P3HIGHCVSS 8.4fixed in 10.0.14393.9339≥ 10.0.14393.0, < 10.0.14393.93392026-07-14
CVE-2026-56189 [HIGH] CWE-122 CVE-2026-56189: Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to
Heap-based buffer overflow in Microsoft Windows Media Foundation allows an unauthorized attacker to execute code locally.
nvd
CVE-2024-49115P3HIGHCVSS 8.1fixed in 10.0.14393.7606≥ 10.0.14393.0, < 10.0.14393.76062024-12-12
CVE-2024-49115 [HIGH] CWE-416 CVE-2024-49115: Windows Remote Desktop Services Remote Code Execution Vulnerability
Windows Remote Desktop Services Remote Code Execution Vulnerability
nvd
CVE-2024-49120P3HIGHCVSS 8.1fixed in 10.0.14393.7606≥ 10.0.14393.0, < 10.0.14393.76992024-12-12
CVE-2024-49120 [HIGH] CWE-453 CVE-2024-49120: Windows Remote Desktop Services Remote Code Execution Vulnerability
Windows Remote Desktop Services Remote Code Execution Vulnerability
nvd
CVE-2023-23416P3HIGHCVSS 7.8≥ 10.0.14393.0, < 10.0.14393.57862023-03-14
CVE-2023-23416 [HIGH] CWE-20 CVE-2023-23416: Windows Cryptographic Services Remote Code Execution Vulnerability
Windows Cryptographic Services Remote Code Execution Vulnerability
nvd
CVE-2026-83522P3HIGHCVSS 8.1fixed in 10.0.14393.9612≥ 10.0.14393.0, < 10.0.14393.96122026-10-13
CVE-2026-83522 [HIGH] CWE-807 CVE-2026-83522: Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized
Reliance on untrusted inputs in a security decision in Windows IKE Extension allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2019-0617P3HIGHCVSS 7.8v1709v18032019-04-08
CVE-2019-0617 [HIGH] CVE-2019-0617: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'.
nvd
CVE-2026-20922P3HIGHCVSS 7.8fixed in 10.0.14393.8783≥ 10.0.14393.0, < 10.0.14393.87832026-01-13
CVE-2026-20922 [HIGH] CWE-122 CVE-2026-20922: Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
nvd
CVE-2019-0595P3HIGHCVSS 7.8v1709v18032019-03-05
CVE-2019-0595 [HIGH] CVE-2019-0595: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-0596, CVE-2019-0597, CVE-2019-0598, CVE-2019-0599, CVE-2019-0625.
nvd
CVE-2023-36400P3HIGHCVSS 8.8≥ 10.0.14393.0, < 10.0.14393.64522023-11-14
CVE-2023-36400 [HIGH] CWE-122 CVE-2023-36400: Windows HMAC Key Derivation Elevation of Privilege Vulnerability
Windows HMAC Key Derivation Elevation of Privilege Vulnerability
nvd
CVE-2025-62458P3HIGHCVSS 7.8fixed in 10.0.14393.8688≥ 10.0.14393.0, < 10.0.14393.86882025-12-09
CVE-2025-62458 [HIGH] CWE-122 CVE-2025-62458: Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privile
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-26128P3HIGHCVSS 7.8fixed in 10.0.14393.8957≥ 10.0.14393.0, < 10.0.14393.89572026-03-10
CVE-2026-26128 [HIGH] CWE-287 CVE-2026-26128: Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges lo
Improper authentication in Windows SMB Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2023-36903P3CRITICALCVSS 9.8≥ 10.0.14393.0, < 10.0.14393.61672023-08-08
CVE-2023-36903 [CRITICAL] CWE-59 CVE-2023-36903: Windows System Assessment Tool Elevation of Privilege Vulnerability
Windows System Assessment Tool Elevation of Privilege Vulnerability
nvd
CVE-2025-48814P3HIGHCVSS 7.5fixed in 10.0.14393.8246≥ 10.0.14393.0, < 10.0.14393.82462025-07-08
CVE-2025-48814 [HIGH] CWE-306 CVE-2025-48814: Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an u
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2019-1243P3HIGHCVSS 7.8v1803v19032019-09-11
CVE-2019-1243 [HIGH] CVE-2019-1243: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1241, CVE-2019-1242, CVE-2019-1246, CVE-2019-1247, CVE-2019-1248, CVE-2019-1249, CVE-2019-1250.
nvd
CVE-2019-1250P3HIGHCVSS 7.8v1803v19032019-09-11
CVE-2019-1250 [HIGH] CVE-2019-1250: A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles
A remote code execution vulnerability exists when the Windows Jet Database Engine improperly handles objects in memory, aka 'Jet Database Engine Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2019-1240, CVE-2019-1241, CVE-2019-1242, CVE-2019-1243, CVE-2019-1246, CVE-2019-1247, CVE-2019-1248, CVE-2019-1249.
nvd
CVE-2026-21239P3HIGHCVSS 7.8fixed in 10.0.14393.8868≥ 10.0.14393.0, < 10.0.14393.88682026-02-10
CVE-2026-21239 [HIGH] CWE-122 CVE-2026-21239: Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges loc
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
nvd