Microsoft Windows Server 2019 vulnerabilities

3,952 known vulnerabilities affecting microsoft/windows_server_2019.

Total CVEs

3,952

CISA KEV

125

actively exploited

Public exploits

113

Exploited in wild

171

Severity breakdown

CRITICAL126HIGH2786MEDIUM1024LOW16

Vulnerabilities

SortPage 56 of 198

CVE-2026-50386P3HIGHCVSS 7.8fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-50386 [HIGH] CWE-122 CVE-2026-50386: Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

nvd

CVE-2026-40399P3HIGHCVSS 7.8fixed in 10.0.17763.8755≥ 10.0.17763.0, < 10.0.17763.87552026-05-12

CVE-2026-40399 [HIGH] CWE-121 CVE-2026-40399: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-34343P3HIGHCVSS 7.8fixed in 10.0.17763.8755≥ 10.0.17763.0, < 10.0.17763.87552026-05-12

CVE-2026-34343 [HIGH] CWE-122 CVE-2026-34343: Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized at Heap-based buffer overflow in Windows Application Identity (AppID) Subsystem allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-50355P3HIGHCVSS 7.5fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-50355 [HIGH] CWE-121 CVE-2026-50355: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.

nvd

CVE-2026-50304P3HIGHCVSS 7.5fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-50304 [HIGH] CWE-121 CVE-2026-50304: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.

nvd

CVE-2026-50478P3HIGHCVSS 7.8fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-50478 [HIGH] CWE-416 CVE-2026-50478: Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-56643P3HIGHCVSS 7.8fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-56643 [HIGH] CWE-416 CVE-2026-56643: Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-56644P3HIGHCVSS 7.8fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-56644 [HIGH] CWE-416 CVE-2026-56644: Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-50471P3HIGHCVSS 7.8fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-50471 [HIGH] CWE-122 CVE-2026-50471: Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.

nvd

CVE-2026-34333P3HIGHCVSS 7.8fixed in 10.0.17763.8755≥ 10.0.17763.0, < 10.0.17763.87552026-05-12

CVE-2026-34333 [HIGH] CWE-190 CVE-2026-34333: Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-58632P3HIGHCVSS 7.8fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-58632 [HIGH] CWE-416 CVE-2026-58632: Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-49791P3HIGHCVSS 7.8fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-49791 [HIGH] CWE-59 CVE-2026-49791: Improper link resolution before file access ('link following') in Windows Routing and Remote Access Improper link resolution before file access ('link following') in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-48583P3HIGHCVSS 7.8fixed in 10.0.17763.8880≥ 10.0.17763.0, < 10.0.17763.88802026-06-09

CVE-2026-48583 [HIGH] CWE-416 CVE-2026-48583: Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally. Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-49793P3HIGHCVSS 7.8fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-49793 [HIGH] CWE-122 CVE-2026-49793: Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to Heap-based buffer overflow in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

nvd

CVE-2026-26159P3HIGHCVSS 7.8fixed in 10.0.17763.8644≥ 10.0.17763.0, < 10.0.17763.86442026-04-14

CVE-2026-26159 [HIGH] CWE-306 CVE-2026-26159: Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an a Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.

nvd

CVE-2023-35644P3HIGHCVSS 7.8≥ 10.0.17763.0, < 10.0.17763.52062023-12-12

CVE-2023-35644 [HIGH] CWE-190 CVE-2023-35644: Windows Sysmain Service Elevation of Privilege Vulnerability Windows Sysmain Service Elevation of Privilege Vulnerability

nvd

CVE-2026-26176P3HIGHCVSS 7.8fixed in 10.0.17763.8644≥ 10.0.17763.0, < 10.0.17763.86442026-04-14

CVE-2026-26176 [HIGH] CWE-122 CVE-2026-26176: Heap-based buffer overflow in Windows Client Side Caching driver (csc.sys) allows an authorized atta Heap-based buffer overflow in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-50333P3HIGHCVSS 7.8fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-50333 [HIGH] CWE-306 CVE-2026-50333: Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker Missing authentication for critical function in Windows Spaceport.sys allows an authorized attacker to elevate privileges locally.

nvd

CVE-2024-49091P3HIGHCVSS 7.2fixed in 10.0.17763.6659≥ 10.0.17763.0, < 10.0.17763.66592024-12-12

CVE-2024-49091 [HIGH] CWE-591 CVE-2024-49091: Windows Domain Name Service Remote Code Execution Vulnerability Windows Domain Name Service Remote Code Execution Vulnerability

nvd

CVE-2026-50696P3HIGHCVSS 7.5fixed in 10.0.17763.9020≥ 10.0.17763.0, < 10.0.17763.90202026-07-14

CVE-2026-50696 [HIGH] CWE-122 CVE-2026-50696: Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized at Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

nvd

← Previous56 / 198Next →