Microsoft Windows Server 2022 vulnerabilities

3,303 known vulnerabilities affecting microsoft/windows_server_2022.

Total CVEs

3,303

CISA KEV

104

actively exploited

Public exploits

Exploited in wild

136

Severity breakdown

CRITICAL99HIGH2369MEDIUM821LOW14

Vulnerabilities

SortPage 144 of 166

CVE-2025-49658P4MEDIUMCVSS 5.5fixed in 10.0.20348.3932≥ 10.0.20348.0, < 10.0.20348.39322025-07-08

CVE-2025-49658 [MEDIUM] CWE-125 CVE-2025-49658: Out-of-bounds read in Windows TDX.sys allows an authorized attacker to disclose information locally. Out-of-bounds read in Windows TDX.sys allows an authorized attacker to disclose information locally.

nvd

CVE-2026-25169P4MEDIUMCVSS 5.5fixed in 10.0.20348.4830≥ 10.0.20348.0, < 10.0.20348.48932026-03-10

CVE-2026-25169 [MEDIUM] CWE-369 CVE-2026-25169: Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service local Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.

nvd

CVE-2025-29808P4MEDIUMCVSS 5.5fixed in 10.0.20348.3453≥ 10.0.20348.0, < 10.0.20348.34532025-04-08

CVE-2025-29808 [MEDIUM] CWE-1240 CVE-2025-29808: Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allow Use of a cryptographic primitive with a risky implementation in Windows Cryptographic Services allows an authorized attacker to disclose information locally.

nvd

CVE-2025-59203P4MEDIUMCVSS 5.5fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14

CVE-2025-59203 [MEDIUM] CWE-532 CVE-2025-59203: Insertion of sensitive information into log file in Windows StateRepository API allows an authorized Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally.

nvd

CVE-2025-59197P4MEDIUMCVSS 5.5fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14

CVE-2025-59197 [MEDIUM] CWE-532 CVE-2025-59197: Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacke Insertion of sensitive information into log file in Windows ETL Channel allows an authorized attacker to disclose information locally.

nvd

CVE-2026-32181P4MEDIUMCVSS 5.5fixed in 10.0.20348.5020≥ 10.0.20348.0, < 10.0.20348.50202026-04-14

CVE-2026-32181 [MEDIUM] CWE-269 CVE-2026-32181: Improper privilege management in Microsoft Windows allows an authorized attacker to deny service loc Improper privilege management in Microsoft Windows allows an authorized attacker to deny service locally.

nvd

CVE-2025-59253P4MEDIUMCVSS 5.5fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14

CVE-2025-59253 [MEDIUM] CWE-284 CVE-2025-59253: Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny Improper access control in Microsoft Windows Search Component allows an authorized attacker to deny service locally.

nvd

CVE-2025-21268P4MEDIUMCVSS 4.3fixed in 10.0.20348.3091≥ 10.0.20348.0, < 10.0.20348.30912025-01-14

CVE-2025-21268 [MEDIUM] CWE-41 CVE-2025-21268: MapUrlToZone Security Feature Bypass Vulnerability MapUrlToZone Security Feature Bypass Vulnerability

nvd

CVE-2026-20834P4MEDIUMCVSS 4.6fixed in 10.0.20348.4648≥ 10.0.20348.0, < 10.0.20348.46482026-01-13

CVE-2026-20834 [MEDIUM] CWE-36 CVE-2026-20834: Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.

nvd

CVE-2025-58717P4MEDIUMCVSS 4.3fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14

CVE-2025-58717 [MEDIUM] CWE-125 CVE-2025-58717: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

nvd

CVE-2025-55700P4MEDIUMCVSS 4.3fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14

CVE-2025-55700 [MEDIUM] CWE-125 CVE-2025-55700: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.

nvd

CVE-2025-54107P4MEDIUMCVSS 4.3fixed in 10.0.20348.4106≥ 10.0.20348.0, < 10.0.20348.41712025-09-09

CVE-2025-54107 [MEDIUM] CWE-41 CVE-2025-54107: Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to b Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

nvd

CVE-2025-54917P4MEDIUMCVSS 4.3fixed in 10.0.20348.4106≥ 10.0.20348.0, < 10.0.20348.41712025-09-09

CVE-2025-54917 [MEDIUM] CWE-693 CVE-2025-54917: Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a sec Protection mechanism failure in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.

nvd

CVE-2023-35642P4MEDIUMCVSS 6.5≥ 10.0.20348.0, < 10.0.20348.21592023-12-12

CVE-2023-35642 [MEDIUM] CWE-682 CVE-2023-35642: Internet Connection Sharing (ICS) Denial of Service Vulnerability Internet Connection Sharing (ICS) Denial of Service Vulnerability

nvd

CVE-2022-44679P4MEDIUMCVSS 6.5≥ 10.0.20348.0, < 10.0.20348.13662022-12-13

CVE-2022-44679 [MEDIUM] CVE-2022-44679: Windows Graphics Component Information Disclosure Vulnerability Windows Graphics Component Information Disclosure Vulnerability

nvd

CVE-2022-37965P4MEDIUMCVSS 5.9≥ 10.0.20348.0, < 10.0.20348.11292022-10-11

CVE-2022-37965 [MEDIUM] CVE-2022-37965: Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability

nvd

CVE-2024-38041P4MEDIUMCVSS 5.5fixed in 10.0.20348.2582≥ 10.0.20348.0, < 10.0.20348.25822024-07-09

CVE-2024-38041 [MEDIUM] CWE-200 CVE-2024-38041: Windows Kernel Information Disclosure Vulnerability Windows Kernel Information Disclosure Vulnerability

nvd

CVE-2022-41090P4MEDIUMCVSS 5.9≥ 10.0.20348.0, < 10.0.20348.12492022-11-09

CVE-2022-41090 [MEDIUM] CWE-362 CVE-2022-41090: Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability

nvd

CVE-2023-28271P4MEDIUMCVSS 5.5≥ 10.0.20348.0, < 10.0.20348.16682023-04-11

CVE-2023-28271 [MEDIUM] CWE-200 CVE-2023-28271: Windows Kernel Memory Information Disclosure Vulnerability Windows Kernel Memory Information Disclosure Vulnerability

nvd

CVE-2025-21321P4MEDIUMCVSS 5.5fixed in 10.0.20348.3091≥ 10.0.20348.0, < 10.0.20348.30912025-01-14

CVE-2025-21321 [MEDIUM] CWE-532 CVE-2025-21321: Windows Kernel Memory Information Disclosure Vulnerability Windows Kernel Memory Information Disclosure Vulnerability

nvd

← Previous144 / 166Next →