cbcvebase.

Microsoft Windows Server 2022 vulnerabilities

3,303 known vulnerabilities affecting microsoft/windows_server_2022.

Total CVEs
3,303
CISA KEV
104
actively exploited
Public exploits
75
Exploited in wild
136
Severity breakdown
CRITICAL99HIGH2369MEDIUM821LOW14

Vulnerabilities

Page 117 of 166
CVE-2023-28234P3HIGHCVSS 7.5≥ 10.0.20348.0, < 10.0.20348.16682023-04-11
CVE-2023-28234 [HIGH] CVE-2023-28234: Windows Secure Channel Denial of Service Vulnerability Windows Secure Channel Denial of Service Vulnerability
nvd
CVE-2023-24859P3HIGHCVSS 7.5≥ 10.0.20348.0, < 10.0.20348.16072023-03-14
CVE-2023-24859 [HIGH] CWE-476 CVE-2023-24859: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability
nvd
CVE-2023-21813P3HIGHCVSS 7.5≥ 10.0.20348.0, < 10.0.20348.15472023-02-14
CVE-2023-21813 [HIGH] CWE-126 CVE-2023-21813: Windows Secure Channel Denial of Service Vulnerability Windows Secure Channel Denial of Service Vulnerability
nvd
CVE-2023-32044P3HIGHCVSS 7.5≥ 10.0.20348.0, < 10.0.20348.18502023-07-11
CVE-2023-32044 [HIGH] CWE-125 CVE-2023-32044: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
nvd
CVE-2023-32045P3HIGHCVSS 7.5≥ 10.0.20348.0, < 10.0.20348.18502023-07-11
CVE-2023-32045 [HIGH] CWE-125 CVE-2023-32045: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
nvd
CVE-2023-36805P4HIGHCVSS 7.0fixed in 10.0.20348.1970≥ 10.0.20348.0, < 10.0.20348.19702023-09-12
CVE-2023-36805 [HIGH] CWE-77 CVE-2023-36805: Windows MSHTML Platform Security Feature Bypass Vulnerability Windows MSHTML Platform Security Feature Bypass Vulnerability
nvd
CVE-2021-43216P3MEDIUMCVSS 6.5≥ 10.0.0, < 10.0.20348.4052021-12-15
CVE-2021-43216 [MEDIUM] CWE-668 CVE-2021-43216: Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability
nvd
CVE-2021-43237P3HIGHCVSS 7.3≥ 10.0.0, < 10.0.20348.4052021-12-15
CVE-2021-43237 [HIGH] CWE-59 CVE-2021-43237: Windows Setup Elevation of Privilege Vulnerability Windows Setup Elevation of Privilege Vulnerability
nvd
CVE-2022-35822P3HIGHCVSS 7.1≥ 10.0.20348.0, < 10.0.20348.8872022-08-15
CVE-2022-35822 [HIGH] CVE-2022-35822: Windows Defender Credential Guard Security Feature Bypass Vulnerability Windows Defender Credential Guard Security Feature Bypass Vulnerability
nvd
CVE-2024-30036P3MEDIUMCVSS 6.5fixed in 10.0.20348.2461≥ 10.0.20348.0, < 10.0.20348.24612024-05-14
CVE-2024-30036 [MEDIUM] CWE-41 CVE-2024-30036: Windows Deployment Services Information Disclosure Vulnerability Windows Deployment Services Information Disclosure Vulnerability
nvd
CVE-2022-21863P4HIGHCVSS 7.0≥ 10.0.20348.0, < 10.0.20348.4692022-01-11
CVE-2022-21863 [HIGH] CVE-2022-21863: Windows StateRepository API Server file Elevation of Privilege Vulnerability Windows StateRepository API Server file Elevation of Privilege Vulnerability
nvd
CVE-2024-30099P4HIGHCVSS 7.0fixed in 10.0.20348.2522≥ 10.0.20348.0, < 10.0.20348.25272024-06-11
CVE-2024-30099 [HIGH] CWE-367 CVE-2024-30099: Windows Kernel Elevation of Privilege Vulnerability Windows Kernel Elevation of Privilege Vulnerability
nvd
CVE-2025-26667P3MEDIUMCVSS 6.5fixed in 10.0.20348.3453≥ 10.0.20348.0, < 10.0.20348.34532025-04-08
CVE-2025-26667 [MEDIUM] CWE-200 CVE-2025-26667: Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Serv Exposure of sensitive information to an unauthorized actor in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2023-35384P4MEDIUMCVSS 6.5≥ 10.0.20348.0, < 10.0.20348.19062023-08-08
CVE-2023-35384 [MEDIUM] CWE-73 CVE-2023-35384: Windows HTML Platforms Security Feature Bypass Vulnerability Windows HTML Platforms Security Feature Bypass Vulnerability
nvd
CVE-2025-27732P4HIGHCVSS 7.0fixed in 10.0.20348.3453≥ 10.0.20348.0, < 10.0.20348.34532025-04-08
CVE-2025-27732 [HIGH] CWE-591 CVE-2025-27732: Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized att Sensitive data storage in improperly locked memory in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-29841P3HIGHCVSS 7.0fixed in 10.0.20348.3692≥ 10.0.20348.0, < 10.0.20348.36922025-05-13
CVE-2025-29841 [HIGH] CWE-362 CVE-2025-29841: Concurrent execution using shared resource with improper synchronization ('race condition') in Unive Concurrent execution using shared resource with improper synchronization ('race condition') in Universal Print Management Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-47975P3HIGHCVSS 7.0fixed in 10.0.20348.3932≥ 10.0.20348.0, < 10.0.20348.39322025-07-08
CVE-2025-47975 [HIGH] CWE-415 CVE-2025-47975: Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally. Double free in Windows SSDP Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-26665P4HIGHCVSS 7.0fixed in 10.0.20348.3453≥ 10.0.20348.0, < 10.0.20348.34532025-04-08
CVE-2025-26665 [HIGH] CWE-591 CVE-2025-26665: Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized atta Sensitive data storage in improperly locked memory in Windows upnphost.dll allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-33057P3MEDIUMCVSS 6.5fixed in 10.0.20348.3745≥ 10.0.20348.0, < 10.0.20348.38072025-06-10
CVE-2025-33057 [MEDIUM] CWE-476 CVE-2025-33057: Null pointer dereference in Windows Local Security Authority (LSA) allows an authorized attacker to Null pointer dereference in Windows Local Security Authority (LSA) allows an authorized attacker to deny service over a network.
nvd
CVE-2025-53807P3HIGHCVSS 7.0fixed in 10.0.20348.4106≥ 10.0.20348.0, < 10.0.20348.41712025-09-09
CVE-2025-53807 [HIGH] CWE-362 CVE-2025-53807: Concurrent execution using shared resource with improper synchronization ('race condition') in Micro Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
nvd
← Previous117 / 166Next →
Microsoft Windows Server 2022 vulnerabilities | cvebase