Microsoft Windows Server 2022 23H2 vulnerabilities

CVE-2024-43515 [HIGH] CWE-400 CVE-2024-43515: Internet Small Computer Systems Interface (iSCSI) Denial of Service Vulnerability Internet Small Computer Systems Interface (iSCSI) Denial of Service Vulnerability

CVE-2024-43545 [HIGH] CWE-400 CVE-2024-43545: Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability Windows Online Certificate Status Protocol (OCSP) Server Denial of Service Vulnerability

CVE-2024-43544 [HIGH] CWE-400 CVE-2024-43544: Microsoft Simple Certificate Enrollment Protocol Denial of Service Vulnerability Microsoft Simple Certificate Enrollment Protocol Denial of Service Vulnerability

CVE-2025-60719 [HIGH] CWE-822 CVE-2025-60719: Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized Untrusted pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

CVE-2024-26216 [HIGH] CWE-59 CVE-2024-26216: Windows File Server Resource Management Service Elevation of Privilege Vulnerability Windows File Server Resource Management Service Elevation of Privilege Vulnerability

CVE-2024-43615 [HIGH] CWE-73 CVE-2024-43615: Microsoft OpenSSH for Windows Remote Code Execution Vulnerability Microsoft OpenSSH for Windows Remote Code Execution Vulnerability

CVE-2025-49680 [HIGH] CWE-59 CVE-2025-49680: Improper link resolution before file access ('link following') in Windows Performance Recorder allow Improper link resolution before file access ('link following') in Windows Performance Recorder allows an authorized attacker to deny service locally.

CVE-2026-32093 [HIGH] CWE-122 CVE-2026-32093: Concurrent execution using shared resource with improper synchronization ('race condition') in Funct Concurrent execution using shared resource with improper synchronization ('race condition') in Function Discovery Service (fdwsd.dll) allows an authorized attacker to elevate privileges locally.

CVE-2025-29968 [MEDIUM] CWE-20 CVE-2025-29968: Improper input validation in Active Directory Certificate Services (AD CS) allows an authorized atta Improper input validation in Active Directory Certificate Services (AD CS) allows an authorized attacker to deny service over a network.

CVE-2024-26233 [MEDIUM] CWE-416 CVE-2024-26233: Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability

CVE-2024-26224 [MEDIUM] CWE-416 CVE-2024-26224: Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability

CVE-2024-26223 [MEDIUM] CWE-416 CVE-2024-26223: Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability

CVE-2024-26231 [MEDIUM] CWE-416 CVE-2024-26231: Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability

CVE-2024-26227 [MEDIUM] CWE-416 CVE-2024-26227: Windows DNS Server Remote Code Execution Vulnerability Windows DNS Server Remote Code Execution Vulnerability

CVE-2026-24285 [HIGH] CWE-416 CVE-2026-24285: Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally. Use after free in Windows Win32K allows an authorized attacker to elevate privileges locally.

CVE-2026-20842 [HIGH] CWE-416 CVE-2026-20842: Use after free in Windows DWM allows an authorized attacker to elevate privileges locally. Use after free in Windows DWM allows an authorized attacker to elevate privileges locally.

CVE-2026-21242 [HIGH] CWE-416 CVE-2026-21242: Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges lo Use after free in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

CVE-2026-25170 [HIGH] CWE-416 CVE-2026-25170: Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally. Use after free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVE-2026-21237 [HIGH] CWE-362 CVE-2026-21237: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Subsystem for Linux allows an authorized attacker to elevate privileges locally.

CVE-2026-34347 [HIGH] CWE-416 CVE-2026-34347: Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally. Use after free in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.