Microsoft Windows Server 2022 vulnerabilities

2,817 known vulnerabilities affecting microsoft/windows_server_2022.

Total CVEs
2,817
CISA KEV
102
actively exploited
Public exploits
38
Exploited in wild
85
Severity breakdown
CRITICAL74HIGH2015MEDIUM717LOW11

Vulnerabilities

Page 19 of 141
CVE-2025-59196HIGHCVSS 7.0fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-59196 [HIGH] CWE-362 CVE-2025-59196: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-58716HIGHCVSS 8.8fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-58716 [HIGH] CWE-20 CVE-2025-58716: Improper input validation in Microsoft Windows Speech allows an authorized attacker to elevate privi Improper input validation in Microsoft Windows Speech allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-58734HIGHCVSS 7.0fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-58734 [HIGH] CWE-416 CVE-2025-58734: Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
cvelistv5nvd
CVE-2025-55331HIGHCVSS 7.0fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-55331 [HIGH] CWE-416 CVE-2025-55331: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges l Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-59195HIGHCVSS 7.0fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-59195 [HIGH] CWE-362 CVE-2025-59195: Concurrent execution using shared resource with improper synchronization ('race condition') in Micro Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to deny service locally.
cvelistv5nvd
CVE-2025-58737HIGHCVSS 7.0fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-58737 [HIGH] CWE-416 CVE-2025-58737: Use after free in Windows Remote Desktop allows an unauthorized attacker to execute code locally. Use after free in Windows Remote Desktop allows an unauthorized attacker to execute code locally.
cvelistv5nvd
CVE-2025-59205HIGHCVSS 7.0fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-59205 [HIGH] CWE-362 CVE-2025-59205: Concurrent execution using shared resource with improper synchronization ('race condition') in Micro Concurrent execution using shared resource with improper synchronization ('race condition') in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-59200HIGHCVSS 7.7fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-59200 [HIGH] CWE-73 CVE-2025-59200: Concurrent execution using shared resource with improper synchronization ('race condition') in Data Concurrent execution using shared resource with improper synchronization ('race condition') in Data Sharing Service Client allows an unauthorized attacker to perform spoofing locally.
cvelistv5nvd
CVE-2025-55685HIGHCVSS 7.0fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-55685 [HIGH] CWE-416 CVE-2025-55685: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges l Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-55678HIGHCVSS 7.0fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-55678 [HIGH] CWE-416 CVE-2025-55678: Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally. Use after free in Windows DirectX allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-59242HIGHCVSS 7.8fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-59242 [HIGH] CWE-122 CVE-2025-59242: Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized att Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-58714HIGHCVSS 7.8fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-58714 [HIGH] CWE-284 CVE-2025-58714: Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attack Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-58733HIGHCVSS 7.0fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-58733 [HIGH] CWE-416 CVE-2025-58733: Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
cvelistv5nvd
CVE-2025-55328HIGHCVSS 7.0fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-55328 [HIGH] CWE-362 CVE-2025-55328: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Hyper-V allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-59208HIGHCVSS 7.1fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-59208 [HIGH] CWE-125 CVE-2025-59208: Out-of-bounds read in Windows MapUrlToZone allows an unauthorized attacker to disclose information o Out-of-bounds read in Windows MapUrlToZone allows an unauthorized attacker to disclose information over a network.
cvelistv5nvd
CVE-2025-59199HIGHCVSS 7.8fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-59199 [HIGH] CWE-284 CVE-2025-59199: Improper access control in Software Protection Platform (SPP) allows an authorized attacker to eleva Improper access control in Software Protection Platform (SPP) allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-55681HIGHCVSS 7.8fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-55681 [HIGH] CWE-125 CVE-2025-55681: Out-of-bounds read in Windows DWM allows an authorized attacker to elevate privileges locally. Out-of-bounds read in Windows DWM allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-59295HIGHCVSS 8.8fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-59295 [HIGH] CWE-122 CVE-2025-59295: Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over Heap-based buffer overflow in Internet Explorer allows an unauthorized attacker to execute code over a network.
cvelistv5nvd
CVE-2025-59289HIGHCVSS 7.0fixed in 10.0.20348.4106≥ 10.0.20348.0, < 10.0.20348.41712025-10-14
CVE-2025-59289 [HIGH] CWE-415 CVE-2025-59289: Double free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally Double free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-58726HIGHCVSS 7.5fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-58726 [HIGH] CWE-284 CVE-2025-58726: Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges ov Improper access control in Windows SMB Server allows an authorized attacker to elevate privileges over a network.
cvelistv5nvd
← Previous19 / 141Next →