Microsoft Windows Server 2019 vulnerabilities

CVE-2026-50335 [HIGH] CWE-284 CVE-2026-50335: Improper access control in Windows Operating Systems allows an authorized attacker to elevate privil Improper access control in Windows Operating Systems allows an authorized attacker to elevate privileges locally.

CVE-2026-50346 [HIGH] CWE-285 CVE-2026-50346: Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally. Improper authorization in RPC Runtime allows an authorized attacker to elevate privileges locally.

CVE-2025-59192 [HIGH] CWE-126 CVE-2025-59192: Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally. Buffer over-read in Storport.sys Driver allows an authorized attacker to elevate privileges locally.

CVE-2026-33834 [HIGH] CWE-284 CVE-2026-33834: Improper access control in Windows Event Logging Service allows an authorized attacker to elevate pr Improper access control in Windows Event Logging Service allows an authorized attacker to elevate privileges locally.

CVE-2025-54913 [HIGH] CWE-362 CVE-2025-54913: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally.

CVE-2026-50491 [HIGH] CWE-125 CVE-2026-50491: Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privilege Out-of-bounds read in Code Integrity DLL (ci.dll) allows an authorized attacker to elevate privileges locally.

CVE-2026-49792 [HIGH] CWE-197 CVE-2026-49792: Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to ex Numeric truncation error in Windows Resilient File System (ReFS) allows an authorized attacker to execute code locally.

CVE-2026-49783 [HIGH] CWE-358 CVE-2026-49783: Improperly implemented security check for standard in Windows Secure Boot allows an authorized attac Improperly implemented security check for standard in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.

CVE-2026-26183 [HIGH] CWE-284 CVE-2026-26183: Improper access control in Windows RPC API allows an authorized attacker to elevate privileges local Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally.

CVE-2025-58714 [HIGH] CWE-284 CVE-2025-58714: Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attack Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2026-34338 [HIGH] CWE-416 CVE-2026-34338: Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges loca Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

CVE-2026-40382 [HIGH] CWE-416 CVE-2026-40382: Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges loca Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.

CVE-2026-20804 [HIGH] CWE-266 CVE-2026-20804: Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.

CVE-2026-50367 [HIGH] CWE-118 CVE-2026-50367: Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an auth Incorrect access of indexable resource ('range error') in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.

CVE-2026-50435 [HIGH] CWE-126 CVE-2026-50435: Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges local Buffer over-read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.

CVE-2026-50670 [HIGH] CWE-20 CVE-2026-50670: Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally. Out-of-bounds read in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-56182 [HIGH] CWE-122 CVE-2026-56182: Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges l Integer overflow or wraparound in Windows NTFS allows an authorized attacker to elevate privileges locally.

CVE-2026-50331 [HIGH] CWE-416 CVE-2026-50331: Use after free in Windows Application Model allows an authorized attacker to elevate privileges loca Use after free in Windows Application Model allows an authorized attacker to elevate privileges locally.

CVE-2026-27920 [HIGH] CWE-822 CVE-2026-27920: Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an author Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.

CVE-2026-20852 [HIGH] CWE-266 CVE-2026-20852: Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering Incorrect privilege assignment in Windows Hello allows an unauthorized attacker to perform tampering locally.