Microsoft Windows Server 2025 vulnerabilities
3,648 known vulnerabilities affecting microsoft/windows_server_2025.
Total CVEs
3,648
CISA KEV
42
actively exploited
Public exploits
32
Exploited in wild
50
Severity breakdown
CRITICAL131HIGH2617MEDIUM891LOW9
Vulnerabilities
Page 120 of 183
CVE-2025-50166P3MEDIUMCVSS 6.5fixed in 10.0.26100.4851≥ 10.0.26100.0, < 10.0.26100.49462025-08-12
CVE-2025-50166 [MEDIUM] CWE-190 CVE-2025-50166: Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized a
Integer overflow or wraparound in Windows Distributed Transaction Coordinator allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-70166P3MEDIUMCVSS 6.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-70166 [MEDIUM] CWE-125 CVE-2026-70166: Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network.
Out-of-bounds read in Windows DNS allows an authorized attacker to deny service over a network.
nvd
CVE-2026-83649P3MEDIUMCVSS 6.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83649 [MEDIUM] CWE-125 CVE-2026-83649: Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorize
Out-of-bounds read in Windows Local Security Authority Subsystem Service (LSASS) allows an authorized attacker to deny service over a network.
nvd
CVE-2026-83667P3MEDIUMCVSS 6.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83667 [MEDIUM] CWE-125 CVE-2026-83667: Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service
Out-of-bounds read in Active Directory Domain Services allows an authorized attacker to deny service over a network.
nvd
CVE-2026-83648P3MEDIUMCVSS 6.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83648 [MEDIUM] CWE-476 CVE-2026-83648: Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny s
Null pointer dereference in Active Directory Domain Services allows an authorized attacker to deny service over a network.
nvd
CVE-2026-69374P3MEDIUMCVSS 6.5fixed in 10.0.26100.33438≥ 10.0.26100.0, < 10.0.26100.334382026-09-08
CVE-2026-69374 [MEDIUM] CWE-770 CVE-2026-69374: Allocation of resources without limits or throttling in Windows SMB Server allows an authorized atta
Allocation of resources without limits or throttling in Windows SMB Server allows an authorized attacker to deny service over a network.
nvd
CVE-2026-83521P3MEDIUMCVSS 6.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83521 [MEDIUM] CWE-125 CVE-2026-83521: Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information ov
Out-of-bounds read in Windows IKE Extension allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-56186P3MEDIUMCVSS 6.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-56186 [MEDIUM] CWE-125 CVE-2026-56186: Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a
Out-of-bounds read in Windows Schannel allows an authorized attacker to disclose information over a network.
nvd
CVE-2025-64670P3MEDIUMCVSS 6.5fixed in 10.0.26100.7392≥ 10.0.26100.0, < 10.0.26100.74622025-12-09
CVE-2025-64670 [MEDIUM] CWE-200 CVE-2025-64670: Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an
Exposure of sensitive information to an unauthorized actor in Microsoft Graphics Component allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-85821P3MEDIUMCVSS 6.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-85821 [MEDIUM] CWE-125 CVE-2026-85821: Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized a
Out-of-bounds read in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to disclose information locally.
nvd
CVE-2026-50432P3MEDIUMCVSS 6.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50432 [MEDIUM] CWE-416 CVE-2026-50432: Use after free in Windows Virtual Filtering Platform (VFP) allows an authorized attacker to deny ser
Use after free in Windows Virtual Filtering Platform (VFP) allows an authorized attacker to deny service over a network.
nvd
CVE-2026-65794P3MEDIUMCVSS 6.5fixed in 10.0.26100.33222≥ 10.0.26100.0, < 10.0.26100.332962026-08-11
CVE-2026-65794 [MEDIUM] CWE-126 CVE-2026-65794: Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over
Buffer over-read in Windows SMB Client allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-96938P3MEDIUMCVSS 6.7fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-96938 [MEDIUM] CWE-122 CVE-2026-96938: Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to
Heap-based buffer overflow in Windows Distributed File System (DFS) allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-85337P3MEDIUMCVSS 6.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-85337 [MEDIUM] CWE-125 CVE-2026-85337: Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information
Out-of-bounds read in Remote Desktop Client allows an unauthorized attacker to disclose information over a network.
nvd
CVE-2026-69350P3MEDIUMCVSS 6.7fixed in 10.0.26100.33438≥ 10.0.26100.0, < 10.0.26100.334382026-09-08
CVE-2026-69350 [MEDIUM] CWE-122 CVE-2026-69350: Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privil
Heap-based buffer overflow in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-42907P3MEDIUMCVSS 6.5fixed in 10.0.26100.32995≥ 10.0.26100.0, < 10.0.26100.329952026-06-09
CVE-2026-42907 [MEDIUM] CWE-200 CVE-2026-42907: Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized att
Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to disclose information over a network.
nvd
CVE-2026-85805P3MEDIUMCVSS 6.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-85805 [MEDIUM] CWE-358 CVE-2026-85805: Improperly implemented security check for standard in Windows PowerShell allows an unauthorized atta
Improperly implemented security check for standard in Windows PowerShell allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2025-21181P3HIGHCVSS 7.5fixed in 10.0.26100.3194≥ 10.0.26100.0, < 10.0.26100.31942025-02-11
CVE-2025-21181 [HIGH] CWE-400 CVE-2025-21181: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
nvd
CVE-2024-49096P3HIGHCVSS 7.5fixed in 10.0.26100.2605≥ 10.0.26100.0, < 10.0.26100.26052024-12-12
CVE-2024-49096 [HIGH] CWE-400 CVE-2024-49096: Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
Microsoft Message Queuing (MSMQ) Denial of Service Vulnerability
nvd
CVE-2024-49075P3HIGHCVSS 7.5fixed in 10.0.26100.2605≥ 10.0.26100.0, < 10.0.26100.26052024-12-12
CVE-2024-49075 [HIGH] CWE-400 CVE-2024-49075: Windows Remote Desktop Services Denial of Service Vulnerability
Windows Remote Desktop Services Denial of Service Vulnerability
nvd