Microsoft Windows Server 2022 vulnerabilities
3,303 known vulnerabilities affecting microsoft/windows_server_2022.
Total CVEs
3,303
CISA KEV
104
actively exploited
Public exploits
75
Exploited in wild
136
Severity breakdown
CRITICAL99HIGH2369MEDIUM821LOW14
Vulnerabilities
Page 45 of 166
CVE-2026-44810P3HIGHCVSS 7.8fixed in 10.0.20348.5256≥ 10.0.20348.0, < 10.0.20348.52562026-06-09
CVE-2026-44810 [HIGH] CWE-287 CVE-2026-44810: Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate
Improper authentication in Windows Cryptographic Services allows an unauthorized attacker to elevate privileges locally.
nvd
CVE-2026-50499P3HIGHCVSS 7.8fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50499 [HIGH] CWE-122 CVE-2026-50499: Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elev
Heap-based buffer overflow in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-58601P3HIGHCVSS 7.8fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-58601 [HIGH] CWE-122 CVE-2026-58601: Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker
Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50451P3HIGHCVSS 7.8fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50451 [HIGH] CWE-306 CVE-2026-50451: Missing authentication for critical function in Windows Routing and Remote Access Service (RRAS) all
Missing authentication for critical function in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-58535P3HIGHCVSS 7.5fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-58535 [HIGH] CWE-908 CVE-2026-58535: Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-58533P3HIGHCVSS 7.5fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-58533 [HIGH] CWE-908 CVE-2026-58533: Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information
Use of uninitialized resource in Windows RDP allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-50497P3HIGHCVSS 7.5fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50497 [HIGH] CWE-193 CVE-2026-50497: Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose info
Off-by-one error in Windows Remote Desktop Protocol allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2025-55326P3HIGHCVSS 7.5fixed in 10.0.20348.4294≥ 10.0.20348.0, < 10.0.20348.42942025-10-14
CVE-2025-55326 [HIGH] CWE-416 CVE-2025-55326: Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to exe
Use after free in Connected Devices Platform Service (Cdpsvc) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2024-38241P3HIGHCVSS 7.8fixed in 10.0.20348.2700≥ 10.0.20348.0, < 10.0.20348.27002024-09-10
CVE-2024-38241 [HIGH] CWE-20 CVE-2024-38241: Kernel Streaming Service Driver Elevation of Privilege Vulnerability
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
nvd
CVE-2026-50445P3HIGHCVSS 7.5fixed in 10.0.20348.5386≥ 10.0.20348.0, < 10.0.20348.53862026-07-14
CVE-2026-50445 [HIGH] CWE-126 CVE-2026-50445: Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a netwo
Buffer over-read in Windows RDP allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-0386P3HIGHCVSS 7.5fixed in 10.0.20348.4648≥ 10.0.20348.0, < 10.0.20348.46482026-01-13
CVE-2026-0386 [HIGH] CWE-284 CVE-2026-0386: Improper access control in Windows Deployment Services allows an unauthorized attacker to execute co
Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network.
nvd
CVE-2025-60704P3HIGHCVSS 7.5fixed in 10.0.20348.4346≥ 10.0.20348.0, < 10.0.20348.44052025-11-11
CVE-2025-60704 [HIGH] CWE-325 CVE-2025-60704: Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges
Missing cryptographic step in Windows Kerberos allows an unauthorized attacker to elevate privileges over a network.
nvd
CVE-2025-49666P3HIGHCVSS 7.2fixed in 10.0.20348.3932≥ 10.0.20348.0, < 10.0.20348.39322025-07-08
CVE-2025-49666 [HIGH] CWE-122 CVE-2025-49666: Heap-based buffer overflow in Windows Kernel allows an authorized attacker to execute code over a ne
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to execute code over a network.
nvd
CVE-2024-43623P3HIGHCVSS 7.8fixed in 10.0.20348.2849≥ 10.0.20348.0, < 10.0.20348.28492024-11-12
CVE-2024-43623 [HIGH] CWE-190 CVE-2024-43623: Windows NT OS Kernel Elevation of Privilege Vulnerability
Windows NT OS Kernel Elevation of Privilege Vulnerability
nvd
CVE-2024-38124P3CRITICALCVSS 9.0fixed in 10.0.20348.2762≥ 10.0.20348.0, < 10.0.20348.27622024-10-08
CVE-2024-38124 [CRITICAL] CWE-287 CVE-2024-38124: Windows Netlogon Elevation of Privilege Vulnerability
Windows Netlogon Elevation of Privilege Vulnerability
nvd
CVE-2024-26211P3HIGHCVSS 7.8fixed in 10.0.20348.2461≥ 10.0.20348.0, < 10.0.20348.24612024-04-09
CVE-2024-26211 [HIGH] CWE-122 CVE-2024-26211: Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
nvd
CVE-2022-37975P3HIGHCVSS 8.8≥ 10.0.20348.0, < 10.0.20348.11292022-10-11
CVE-2022-37975 [HIGH] CVE-2022-37975: Windows Group Policy Elevation of Privilege Vulnerability
Windows Group Policy Elevation of Privilege Vulnerability
nvd
CVE-2022-37970P3HIGHCVSS 7.8≥ 10.0.20348.0, < 10.0.20348.11292022-10-11
CVE-2022-37970 [HIGH] CVE-2022-37970: Windows DWM Core Library Elevation of Privilege Vulnerability
Windows DWM Core Library Elevation of Privilege Vulnerability
nvd
CVE-2022-24542P3HIGHCVSS 7.8≥ 10.0.20348.0, < 10.0.20348.6432022-04-15
CVE-2022-24542 [HIGH] CVE-2022-24542: Windows Win32k Elevation of Privilege Vulnerability
Windows Win32k Elevation of Privilege Vulnerability
nvd
CVE-2024-49105P3HIGHCVSS 8.4fixed in 10.0.20348.2966≥ 10.0.20348.0, < 10.0.20348.29662024-12-12
CVE-2024-49105 [HIGH] CWE-284 CVE-2024-49105: Remote Desktop Client Remote Code Execution Vulnerability
Remote Desktop Client Remote Code Execution Vulnerability
nvd