Microsoft Windows Server 2022 23H2 vulnerabilities
1,556 known vulnerabilities affecting microsoft/windows_server_2022_23h2.
Total CVEs
1,556
CISA KEV
52
actively exploited
Public exploits
39
Exploited in wild
63
Severity breakdown
CRITICAL25HIGH1099MEDIUM426LOW6
Vulnerabilities
Page 36 of 78
CVE-2025-62565P3HIGHCVSS 7.3fixed in 10.0.25398.20252025-12-09
CVE-2025-62565 [HIGH] CWE-416 CVE-2025-62565: Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
nvd
CVE-2024-21417P3HIGHCVSS 8.8fixed in 10.0.25398.10092024-07-10
CVE-2024-21417 [HIGH] CWE-862 CVE-2024-21417: Windows Text Services Framework Elevation of Privilege Vulnerability
Windows Text Services Framework Elevation of Privilege Vulnerability
nvd
CVE-2025-48822P3HIGHCVSS 8.6fixed in 10.0.25398.17322025-07-08
CVE-2025-48822 [HIGH] CWE-125 CVE-2025-48822: Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
nvd
CVE-2024-49019P3HIGHCVSS 7.8fixed in 10.0.25398.12512024-11-12
CVE-2024-49019 [HIGH] CWE-1390 CVE-2024-49019: Active Directory Certificate Services Elevation of Privilege Vulnerability
Active Directory Certificate Services Elevation of Privilege Vulnerability
nvd
CVE-2024-20696P3HIGHCVSS 7.3fixed in 10.0.25398.6432024-01-09
CVE-2024-20696 [HIGH] CWE-122 CVE-2024-20696: Windows libarchive Remote Code Execution Vulnerability
Windows libarchive Remote Code Execution Vulnerability
nvd
CVE-2024-38062P3HIGHCVSS 7.8fixed in 10.0.25398.10092024-07-09
CVE-2024-38062 [HIGH] CWE-125 CVE-2024-38062: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
nvd
CVE-2025-27479P3HIGHCVSS 7.5fixed in 10.0.25398.15512025-04-08
CVE-2025-27479 [HIGH] CWE-410 CVE-2025-27479: Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over
Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over a network.
nvd
CVE-2024-38245P3HIGHCVSS 7.8fixed in 10.0.25398.11282024-09-10
CVE-2024-38245 [HIGH] CWE-20 CVE-2024-38245: Kernel Streaming Service Driver Elevation of Privilege Vulnerability
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
nvd
CVE-2025-33050P3HIGHCVSS 7.5fixed in 10.0.25398.16652025-06-10
CVE-2025-33050 [HIGH] CWE-693 CVE-2025-33050: Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service
Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-32725P3HIGHCVSS 7.5fixed in 10.0.25398.16652025-06-10
CVE-2025-32725 [HIGH] CWE-693 CVE-2025-32725: Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service
Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-29812P3HIGHCVSS 7.8fixed in 10.0.25398.15512025-04-08
CVE-2025-29812 [HIGH] CWE-822 CVE-2025-29812: Untrusted pointer dereference in Windows Kernel Memory allows an authorized attacker to elevate priv
Untrusted pointer dereference in Windows Kernel Memory allows an authorized attacker to elevate privileges locally.
nvd
CVE-2024-21363P3HIGHCVSS 7.8fixed in 10.0.25398.7092024-02-13
CVE-2024-21363 [HIGH] CWE-843 CVE-2024-21363: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
nvd
CVE-2026-20875P3HIGHCVSS 7.5fixed in 10.0.25398.20922026-01-13
CVE-2026-20875 [HIGH] CWE-476 CVE-2026-20875: Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an una
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
nvd
CVE-2024-38243P3HIGHCVSS 7.8fixed in 10.0.25398.11282024-09-10
CVE-2024-38243 [HIGH] CWE-20 CVE-2024-38243: Kernel Streaming Service Driver Elevation of Privilege Vulnerability
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
nvd
CVE-2024-38238P3HIGHCVSS 7.8fixed in 10.0.25398.11282024-09-10
CVE-2024-38238 [HIGH] CWE-122 CVE-2024-38238: Kernel Streaming Service Driver Elevation of Privilege Vulnerability
Kernel Streaming Service Driver Elevation of Privilege Vulnerability
nvd
CVE-2024-38057P3HIGHCVSS 7.8fixed in 10.0.25398.10092024-07-09
CVE-2024-38057 [HIGH] CWE-125 CVE-2024-38057: Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
nvd
CVE-2025-33056P3HIGHCVSS 7.5fixed in 10.0.25398.16652025-06-10
CVE-2025-33056 [HIGH] CWE-284 CVE-2025-33056: Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized
Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network.
nvd
CVE-2024-38134P3HIGHCVSS 7.8fixed in 10.0.25398.10852024-08-13
CVE-2024-38134 [HIGH] CWE-125 CVE-2024-38134: Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
nvd
CVE-2025-26677P3HIGHCVSS 7.5fixed in 10.0.25398.16112025-05-13
CVE-2025-26677 [HIGH] CWE-400 CVE-2025-26677: Uncontrolled resource consumption in Remote Desktop Gateway Service allows an unauthorized attacker
Uncontrolled resource consumption in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-21375P3HIGHCVSS 7.8fixed in 10.0.25398.14252025-02-11
CVE-2025-21375 [HIGH] CWE-20 CVE-2025-21375: Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
Kernel Streaming WOW Thunk Service Driver Elevation of Privilege Vulnerability
nvd