Microsoft Windows Server 2019 vulnerabilities
3,952 known vulnerabilities affecting microsoft/windows_server_2019.
Total CVEs
3,952
CISA KEV
125
actively exploited
Public exploits
113
Exploited in wild
171
Severity breakdown
CRITICAL126HIGH2786MEDIUM1024LOW16
Vulnerabilities
Page 173 of 198
CVE-2025-21323P4MEDIUMCVSS 5.5fixed in 10.0.17763.6775≥ 10.0.17763.0, < 10.0.17763.67752025-01-14
CVE-2025-21323 [MEDIUM] CWE-532 CVE-2025-21323: Windows Kernel Memory Information Disclosure Vulnerability
Windows Kernel Memory Information Disclosure Vulnerability
nvd
CVE-2025-27742P4MEDIUMCVSS 5.5fixed in 10.0.17763.7136≥ 10.0.17763.0, < 10.0.17763.71362025-04-08
CVE-2025-27742 [MEDIUM] CWE-125 CVE-2025-27742: Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.
Out-of-bounds read in Windows NTFS allows an unauthorized attacker to disclose information locally.
nvd
CVE-2024-26207P4MEDIUMCVSS 5.5fixed in 10.0.17763.5820≥ 10.0.17763.0, < 10.0.17763.58202024-04-09
CVE-2024-26207 [MEDIUM] CWE-125 CVE-2024-26207: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
nvd
CVE-2024-28902P4MEDIUMCVSS 5.5fixed in 10.0.17763.5820≥ 10.0.17763.0, < 10.0.17763.58202024-04-09
CVE-2024-28902 [MEDIUM] CWE-126 CVE-2024-28902: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
nvd
CVE-2024-26255P4MEDIUMCVSS 5.5fixed in 10.0.17763.5696≥ 10.0.17763.0, < 10.0.17763.56962024-04-09
CVE-2024-26255 [MEDIUM] CWE-126 CVE-2024-26255: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
nvd
CVE-2024-30039P4MEDIUMCVSS 5.5fixed in 10.0.17763.5820≥ 10.0.17763.0, < 10.0.17763.58202024-05-14
CVE-2024-30039 [MEDIUM] CWE-126 CVE-2024-30039: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
nvd
CVE-2024-38203P4MEDIUMCVSS 5.5fixed in 10.0.17763.6532≥ 10.0.17763.0, < 10.0.17763.65322024-11-12
CVE-2024-38203 [MEDIUM] CWE-693 CVE-2024-38203: Windows Package Library Manager Information Disclosure Vulnerability
Windows Package Library Manager Information Disclosure Vulnerability
nvd
CVE-2024-28900P4MEDIUMCVSS 5.5fixed in 10.0.17763.5820≥ 10.0.17763.0, < 10.0.17763.58202024-04-09
CVE-2024-28900 [MEDIUM] CWE-126 CVE-2024-28900: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
nvd
CVE-2024-28901P4MEDIUMCVSS 5.5fixed in 10.0.17763.5696≥ 10.0.17763.0, < 10.0.17763.56962024-04-09
CVE-2024-28901 [MEDIUM] CWE-126 CVE-2024-28901: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Windows Remote Access Connection Manager Information Disclosure Vulnerability
nvd
CVE-2024-38118P4MEDIUMCVSS 5.5fixed in 10.0.17763.6189≥ 10.0.17763.0, < 10.0.17763.61892024-08-13
CVE-2024-38118 [MEDIUM] CWE-908 CVE-2024-38118: Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
nvd
CVE-2024-38122P4MEDIUMCVSS 5.5fixed in 10.0.17763.6189≥ 10.0.17763.0, < 10.0.17763.61892024-08-13
CVE-2024-38122 [MEDIUM] CWE-908 CVE-2024-38122: Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
nvd
CVE-2023-36724P4MEDIUMCVSS 5.5≥ 10.0.17763.0, < 10.0.17763.49742023-10-10
CVE-2023-36724 [MEDIUM] CWE-287 CVE-2023-36724: Windows Power Management Service Information Disclosure Vulnerability
Windows Power Management Service Information Disclosure Vulnerability
nvd
CVE-2025-59190P4MEDIUMCVSS 5.5fixed in 10.0.17763.7919≥ 10.0.17763.0, < 10.0.17763.79192025-10-14
CVE-2025-59190 [MEDIUM] CWE-20 CVE-2025-59190: Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to d
Improper input validation in Microsoft Windows Search Component allows an unauthorized attacker to deny service locally.
nvd
CVE-2023-23394P4MEDIUMCVSS 5.5≥ 10.0.17763.0, < 10.0.17763.41312023-03-14
CVE-2023-23394 [MEDIUM] CWE-822 CVE-2023-23394: Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability
Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability
nvd
CVE-2023-23409P4MEDIUMCVSS 5.5≥ 10.0.17763.0, < 10.0.17763.41312023-03-14
CVE-2023-23409 [MEDIUM] CWE-20 CVE-2023-23409: Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability
Client Server Run-Time Subsystem (CSRSS) Information Disclosure Vulnerability
nvd
CVE-2026-25168P4MEDIUMCVSS 5.5fixed in 10.0.17763.8511≥ 10.0.17763.0, < 10.0.17763.85112026-03-10
CVE-2026-25168 [MEDIUM] CWE-476 CVE-2026-25168: Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny ser
Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.
nvd
CVE-2024-20662P4MEDIUMCVSS 4.9≥ 10.0.17763.0, < 10.0.17763.53292024-01-09
CVE-2024-20662 [MEDIUM] CWE-843 CVE-2024-20662: Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability
Windows Online Certificate Status Protocol (OCSP) Information Disclosure Vulnerability
nvd
CVE-2026-34339P4MEDIUMCVSS 5.5fixed in 10.0.17763.8755≥ 10.0.17763.0, < 10.0.17763.87552026-05-12
CVE-2026-34339 [MEDIUM] CWE-476 CVE-2026-34339: Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorize
Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an authorized attacker to deny service locally.
nvd
CVE-2019-0941P4MEDIUMCVSS 4.4≥ 10.0.17763.0, < publication2019-06-12
CVE-2019-0941 [MEDIUM] CWE-19 CVE-2019-0941: A denial of service exists in Microsoft IIS Server when the optional request filtering feature impro
A denial of service exists in Microsoft IIS Server when the optional request filtering feature improperly handles requests. An attacker who successfully exploited this vulnerability could perform a temporary denial of service against pages configured to use request filtering.
To exploit this vulnerability, an attacker could send a specially crafted req
nvd
CVE-2023-32083P4MEDIUMCVSS 4.9≥ 10.0.17763.0, < 10.0.17763.46452023-07-11
CVE-2023-32083 [MEDIUM] CWE-122 CVE-2023-32083: Microsoft Failover Cluster Information Disclosure Vulnerability
Microsoft Failover Cluster Information Disclosure Vulnerability
nvd