cbcvebase.

Microsoft Windows Server 2022 vulnerabilities

3,303 known vulnerabilities affecting microsoft/windows_server_2022.

Total CVEs
3,303
CISA KEV
104
actively exploited
Public exploits
75
Exploited in wild
136
Severity breakdown
CRITICAL99HIGH2369MEDIUM821LOW14

Vulnerabilities

Page 133 of 166
CVE-2024-43643P4MEDIUMCVSS 6.8fixed in 10.0.20348.2849≥ 10.0.20348.0, < 10.0.20348.28492024-11-12
CVE-2024-43643 [MEDIUM] CWE-125 CVE-2024-43643: Windows USB Video Class System Driver Elevation of Privilege Vulnerability Windows USB Video Class System Driver Elevation of Privilege Vulnerability
nvd
CVE-2024-38223P4MEDIUMCVSS 6.8fixed in 10.0.20348.2655≥ 10.0.20348.0, < 10.0.20348.26552024-08-13
CVE-2024-38223 [MEDIUM] CWE-284 CVE-2024-38223: Windows Initial Machine Configuration Elevation of Privilege Vulnerability Windows Initial Machine Configuration Elevation of Privilege Vulnerability
nvd
CVE-2022-21963P4MEDIUMCVSS 6.8≥ 10.0.20348.0, < 10.0.20348.4692022-01-11
CVE-2022-21963 [MEDIUM] CVE-2022-21963: Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
nvd
CVE-2025-24987P4MEDIUMCVSS 6.8fixed in 10.0.20348.3328≥ 10.0.20348.0, < 10.0.20348.33282025-03-11
CVE-2025-24987 [MEDIUM] CWE-125 CVE-2025-24987: Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges w Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
nvd
CVE-2025-24988P4MEDIUMCVSS 6.8fixed in 10.0.20348.3328≥ 10.0.20348.0, < 10.0.20348.33282025-03-11
CVE-2025-24988 [MEDIUM] CWE-125 CVE-2025-24988: Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges w Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to elevate privileges with a physical attack.
nvd
CVE-2025-49751P4MEDIUMCVSS 6.8fixed in 10.0.20348.3989≥ 10.0.20348.0, < 10.0.20348.40522025-08-12
CVE-2025-49751 [MEDIUM] CWE-820 CVE-2025-49751: Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adj Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.
nvd
CVE-2025-47999P4MEDIUMCVSS 6.8fixed in 10.0.20348.3932≥ 10.0.20348.0, < 10.0.20348.39322025-07-08
CVE-2025-47999 [MEDIUM] CWE-820 CVE-2025-47999: Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adj Missing synchronization in Windows Hyper-V allows an authorized attacker to deny service over an adjacent network.
nvd
CVE-2022-38032P4MEDIUMCVSS 6.6≥ 10.0.20348.0, < 10.0.20348.11292022-10-11
CVE-2022-38032 [MEDIUM] CVE-2022-38032: Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability
nvd
CVE-2023-32055P4MEDIUMCVSS 6.7≥ 10.0.20348.0, < 10.0.20348.18502023-07-11
CVE-2023-32055 [MEDIUM] CWE-416 CVE-2023-32055: Active Template Library Elevation of Privilege Vulnerability Active Template Library Elevation of Privilege Vulnerability
nvd
CVE-2022-22023P4MEDIUMCVSS 6.6≥ 10.0.20348.0, < 10.0.20348.8252022-07-12
CVE-2022-22023 [MEDIUM] CVE-2022-22023: Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability Windows Portable Device Enumerator Service Security Feature Bypass Vulnerability
nvd
CVE-2025-21242P4MEDIUMCVSS 5.9fixed in 10.0.20348.3091≥ 10.0.20348.0, < 10.0.20348.30912025-01-14
CVE-2025-21242 [MEDIUM] CWE-200 CVE-2025-21242: Windows Kerberos Information Disclosure Vulnerability Windows Kerberos Information Disclosure Vulnerability
nvd
CVE-2025-47980P4MEDIUMCVSS 6.2fixed in 10.0.20348.3932≥ 10.0.20348.0, < 10.0.20348.39322025-07-08
CVE-2025-47980 [MEDIUM] CWE-200 CVE-2025-47980: Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an un Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally.
nvd
CVE-2023-24900P4MEDIUMCVSS 5.9≥ 10.0.20348.0, < 10.0.20348.17262023-05-09
CVE-2023-24900 [MEDIUM] CWE-125 CVE-2023-24900: Windows NTLM Security Support Provider Information Disclosure Vulnerability Windows NTLM Security Support Provider Information Disclosure Vulnerability
nvd
CVE-2026-49807P4MEDIUMCVSS 6.2fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-49807 [MEDIUM] CWE-200 CVE-2026-49807: Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized Exposure of sensitive information to an unauthorized actor in Windows DirectX allows an unauthorized attacker to disclose information locally.
nvd
CVE-2026-50294P4MEDIUMCVSS 6.2fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50294 [MEDIUM] CWE-497 CVE-2026-50294: Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows Exposure of sensitive system information to an unauthorized control sphere in Windows Kernel allows an unauthorized attacker to disclose information locally.
nvd
CVE-2025-32722P4MEDIUMCVSS 5.5fixed in 10.0.20348.3745≥ 10.0.20348.0, < 10.0.20348.38072025-06-10
CVE-2025-32722 [MEDIUM] CWE-284 CVE-2025-32722: Improper access control in Windows Storage Port Driver allows an authorized attacker to disclose inf Improper access control in Windows Storage Port Driver allows an authorized attacker to disclose information locally.
nvd
CVE-2026-25180P4MEDIUMCVSS 5.5fixed in 10.0.20348.4830≥ 10.0.20348.0, < 10.0.20348.48932026-03-10
CVE-2026-25180 [MEDIUM] CWE-125 CVE-2026-25180: Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose infor Out-of-bounds read in Microsoft Graphics Component allows an unauthorized attacker to disclose information locally.
nvd
CVE-2026-20827P4MEDIUMCVSS 5.5fixed in 10.0.20348.4648≥ 10.0.20348.0, < 10.0.20348.46482026-01-13
CVE-2026-20827 [MEDIUM] CWE-200 CVE-2026-20827: Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface (TWINUI) Exposure of sensitive information to an unauthorized actor in Tablet Windows User Interface (TWINUI) Subsystem allows an authorized attacker to disclose information locally.
nvd
CVE-2026-25186P4MEDIUMCVSS 5.5fixed in 10.0.20348.4830≥ 10.0.20348.0, < 10.0.20348.48932026-03-10
CVE-2026-25186 [MEDIUM] CWE-200 CVE-2026-25186: Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure ( Exposure of sensitive information to an unauthorized actor in Windows Accessibility Infrastructure (ATBroker.exe) allows an authorized attacker to disclose information locally.
nvd
CVE-2025-54101P4MEDIUMCVSS 4.8fixed in 10.0.20348.4106≥ 10.0.20348.0, < 10.0.20348.41712025-09-09
CVE-2025-54101 [MEDIUM] CWE-416 CVE-2025-54101: Use after free in Windows SMBv3 Client allows an authorized attacker to execute code over a network. Use after free in Windows SMBv3 Client allows an authorized attacker to execute code over a network.
nvd
← Previous133 / 166Next →
Microsoft Windows Server 2022 vulnerabilities | cvebase