Microsoft Windows Server 2022 vulnerabilities

5,122 known vulnerabilities affecting microsoft/windows_server_2022.

Total CVEs

5,122

CISA KEV

108

actively exploited

Public exploits

Exploited in wild

139

Severity breakdown

CRITICAL186HIGH3667MEDIUM1255LOW14

Vulnerabilities

SortPage 8 of 257

CVE-2023-38545P2CRITICALCVSS 9.8fixed in 10.0.20348.21132023-10-18

CVE-2023-38545 [CRITICAL] CWE-787 CVE-2023-38545: This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked This flaw makes curl overflow a heap based buffer in the SOCKS5 proxy handshake. When curl is asked to pass along the host name to the SOCKS5 proxy to allow that to resolve the address instead of it getting done by curl itself, the maximum length that host name can be is 255 bytes. If the host name is detected to be longer, curl switches to local

nvd

CVE-2022-34718P2CRITICALCVSS 9.8≥ 10.0.20348.0, < 10.0.20348.10062022-09-13

CVE-2022-34718 [CRITICAL] CVE-2022-34718: Windows TCP/IP Remote Code Execution Vulnerability Windows TCP/IP Remote Code Execution Vulnerability

nvd

CVE-2023-35628P2HIGHCVSS 8.1≥ 10.0.20348.0, < 10.0.20348.21592023-12-12

CVE-2023-35628 [HIGH] CWE-416 CVE-2023-35628: Windows MSHTML Platform Remote Code Execution Vulnerability Windows MSHTML Platform Remote Code Execution Vulnerability

nvd

CVE-2024-30080P2CRITICALCVSS 9.8fixed in 10.0.20348.2522≥ 10.0.20348.0, < 10.0.20348.25272024-06-11

CVE-2024-30080 [CRITICAL] CWE-416 CVE-2024-30080: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

nvd

CVE-2025-53778P2HIGHCVSS 8.8fixed in 10.0.20348.3989≥ 10.0.20348.0, < 10.0.20348.40522025-08-12

CVE-2025-53778 [HIGH] CWE-287 CVE-2025-53778: Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a n Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.

nvd

CVE-2026-20929P2HIGHCVSS 7.5PoCfixed in 10.0.20348.4648≥ 10.0.20348.0, < 10.0.20348.46482026-01-13

CVE-2026-20929 [HIGH] CWE-284 CVE-2026-20929: Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.

nvd

CVE-2022-21972P2HIGHCVSS 8.1≥ 10.0.20348.0, < 10.0.20348.7072022-05-10

CVE-2022-21972 [HIGH] CVE-2022-21972: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability

nvd

CVE-2024-30085P3HIGHCVSS 7.8PoCfixed in 10.0.20348.2522≥ 10.0.20348.0, < 10.0.20348.25272024-06-11

CVE-2024-30085 [HIGH] CWE-122 CVE-2024-30085: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

nvd

CVE-2022-37958P2HIGHCVSS 8.1≥ 10.0.20348.0, < 10.0.20348.10062022-09-13

CVE-2022-37958 [HIGH] CVE-2022-37958: SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability SPNEGO Extended Negotiation (NEGOEX) Security Mechanism Remote Code Execution Vulnerability

nvd

CVE-2025-50154P3MEDIUMCVSS 6.5PoCfixed in 10.0.20348.3989≥ 10.0.20348.0, < 10.0.20348.40522025-08-12

CVE-2025-50154 [MEDIUM] CWE-200 CVE-2025-50154: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauth Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.

nvd

CVE-2025-47981P2CRITICALCVSS 9.8fixed in 10.0.20348.3932≥ 10.0.20348.0, < 10.0.20348.39322025-07-08

CVE-2025-47981 [CRITICAL] CWE-122 CVE-2025-47981: Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to Heap-based buffer overflow in Windows SPNEGO Extended Negotiation allows an unauthorized attacker to execute code over a network.

nvd

CVE-2022-23270P2HIGHCVSS 8.1≥ 10.0.20348.0, < 10.0.20348.7072022-05-10

CVE-2022-23270 [HIGH] CVE-2022-23270: Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability

nvd

CVE-2022-24497P2CRITICALCVSS 9.8≥ 10.0.20348.0, < 10.0.20348.6432022-04-15

CVE-2022-24497 [CRITICAL] CVE-2022-24497: Windows Network File System Remote Code Execution Vulnerability Windows Network File System Remote Code Execution Vulnerability

nvd

CVE-2023-21690P2CRITICALCVSS 9.8≥ 10.0.20348.0, < 10.0.20348.15472023-02-14

CVE-2023-21690 [CRITICAL] CWE-122 CVE-2023-21690: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

nvd

CVE-2022-24491P2CRITICALCVSS 9.8≥ 10.0.20348.0, < 10.0.20348.6432022-04-15

CVE-2022-24491 [CRITICAL] CVE-2022-24491: Windows Network File System Remote Code Execution Vulnerability Windows Network File System Remote Code Execution Vulnerability

nvd

CVE-2023-21689P2CRITICALCVSS 9.8≥ 10.0.20348.0, < 10.0.20348.15472023-02-14

CVE-2023-21689 [CRITICAL] CWE-122 CVE-2023-21689: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

nvd

CVE-2025-47987P3HIGHCVSS 7.8PoCfixed in 10.0.20348.3932≥ 10.0.20348.0, < 10.0.20348.39322025-07-08

CVE-2025-47987 [HIGH] CWE-122 CVE-2025-47987: Heap-based buffer overflow in Windows Cred SSProvider Protocol allows an authorized attacker to elev Heap-based buffer overflow in Windows Cred SSProvider Protocol allows an authorized attacker to elevate privileges locally.

nvd

CVE-2026-47291P2CRITICALCVSS 9.8fixed in 10.0.20348.5256≥ 10.0.20348.0, < 10.0.20348.52562026-06-09

CVE-2026-47291 [CRITICAL] CWE-122 CVE-2026-47291: Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code o Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.

nvd

CVE-2023-21692P2CRITICALCVSS 9.8≥ 10.0.20348.0, < 10.0.20348.15472023-02-14

CVE-2023-21692 [CRITICAL] CWE-122 CVE-2023-21692: Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability Microsoft Protected Extensible Authentication Protocol (PEAP) Remote Code Execution Vulnerability

nvd

CVE-2025-54918P2HIGHCVSS 8.8fixed in 10.0.20348.4106≥ 10.0.20348.0, < 10.0.20348.41712025-09-09

CVE-2025-54918 [HIGH] CWE-287 CVE-2025-54918: Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a n Improper authentication in Windows NTLM allows an authorized attacker to elevate privileges over a network.

nvd

← Previous8 / 257Next →