Microsoft Windows Server 2022 vulnerabilities
3,303 known vulnerabilities affecting microsoft/windows_server_2022.
Total CVEs
3,303
CISA KEV
104
actively exploited
Public exploits
75
Exploited in wild
136
Severity breakdown
CRITICAL99HIGH2369MEDIUM821LOW14
Vulnerabilities
Page 111 of 166
CVE-2026-54107P3HIGHCVSS 7.0fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-54107 [HIGH] CWE-362 CVE-2026-54107: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50321P3HIGHCVSS 7.0fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50321 [HIGH] CWE-362 CVE-2026-50321: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows USB Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-34334P3HIGHCVSS 7.0fixed in 10.0.20348.5074≥ 10.0.20348.0, < 10.0.20348.51392026-05-12
CVE-2026-34334 [HIGH] CWE-362 CVE-2026-34334: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-49803P3HIGHCVSS 7.0fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-49803 [HIGH] CWE-362 CVE-2026-49803: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows AppX Deployment Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-49183P3HIGHCVSS 7.0fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-49183 [HIGH] CWE-362 CVE-2026-49183: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clipboard Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-54112P3HIGHCVSS 7.0fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-54112 [HIGH] CWE-362 CVE-2026-54112: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50384P3HIGHCVSS 7.0fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50384 [HIGH] CWE-362 CVE-2026-50384: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Clip Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50450P3HIGHCVSS 7.0fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50450 [HIGH] CWE-362 CVE-2026-50450: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Wireless Wide Area Network Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50669P3HIGHCVSS 7.0fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50669 [HIGH] CWE-362 CVE-2026-50669: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-50172P3MEDIUMCVSS 6.5fixed in 10.0.20348.3989≥ 10.0.20348.0, < 10.0.20348.40522025-08-12
CVE-2025-50172 [MEDIUM] CWE-770 CVE-2025-50172: Allocation of resources without limits or throttling in Windows DirectX allows an authorized attacke
Allocation of resources without limits or throttling in Windows DirectX allows an authorized attacker to deny service over a network.
nvd
CVE-2025-24996P3MEDIUMCVSS 6.5fixed in 10.0.20348.3328≥ 10.0.20348.0, < 10.0.20348.33282025-03-11
CVE-2025-24996 [MEDIUM] CWE-73 CVE-2025-24996: External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spo
External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2026-50426P3MEDIUMCVSS 6.8fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50426 [MEDIUM] CWE-23 CVE-2026-50426: Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent
Relative path traversal in DNS Server allows an authorized attacker to execute code over an adjacent network.
nvd
CVE-2026-50668P3MEDIUMCVSS 6.8fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50668 [MEDIUM] CWE-122 CVE-2026-50668: Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to elevate privileges wit
Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to elevate privileges with a physical attack.
nvd
CVE-2023-35348P3MEDIUMCVSS 6.5≥ 10.0.20348.0, < 10.0.20348.18502023-07-11
CVE-2023-35348 [MEDIUM] CWE-522 CVE-2023-35348: Active Directory Federation Service Security Feature Bypass Vulnerability
Active Directory Federation Service Security Feature Bypass Vulnerability
nvd
CVE-2025-58729P3MEDIUMCVSS 6.5fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-58729 [MEDIUM] CWE-1287 CVE-2025-58729: Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an auth
Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
nvd
CVE-2023-35351P3MEDIUMCVSS 6.6≥ 10.0.20348.0, < 10.0.20348.18502023-07-11
CVE-2023-35351 [MEDIUM] CWE-416 CVE-2023-35351: Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability
nvd
CVE-2023-35346P3MEDIUMCVSS 6.6≥ 10.0.20348.0, < 10.0.20348.18502023-07-11
CVE-2023-35346 [MEDIUM] CWE-591 CVE-2023-35346: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2023-35345P3MEDIUMCVSS 6.6≥ 10.0.20348.0, < 10.0.20348.18502023-07-11
CVE-2023-35345 [MEDIUM] CWE-591 CVE-2023-35345: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2023-35344P3MEDIUMCVSS 6.6≥ 10.0.20348.0, < 10.0.20348.18502023-07-11
CVE-2023-35344 [MEDIUM] CWE-591 CVE-2023-35344: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd
CVE-2023-35310P3MEDIUMCVSS 6.6≥ 10.0.20348.0, < 10.0.20348.18502023-07-11
CVE-2023-35310 [MEDIUM] CWE-591 CVE-2023-35310: Windows DNS Server Remote Code Execution Vulnerability
Windows DNS Server Remote Code Execution Vulnerability
nvd