Microsoft Windows Server 2025 vulnerabilities

1,143 known vulnerabilities affecting microsoft/windows_server_2025.

Total CVEs
1,143
CISA KEV
36
actively exploited
Public exploits
17
Exploited in wild
5
Severity breakdown
CRITICAL14HIGH797MEDIUM327LOW5

Vulnerabilities

Page 22 of 58
CVE-2025-55691HIGHCVSS 7.0fixed in 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-55691 [HIGH] CWE-416 CVE-2025-55691: Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges l Use after free in Windows PrintWorkflowUserSvc allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-59194HIGHCVSS 7.0≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-59194 [HIGH] CWE-908 CVE-2025-59194: Use of uninitialized resource in Windows Kernel allows an authorized attacker to elevate privileges Use of uninitialized resource in Windows Kernel allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-50174HIGHCVSS 7.0≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-50174 [HIGH] CWE-416 CVE-2025-50174: Use after free in Windows Device Association Broker service allows an authorized attacker to elevate Use after free in Windows Device Association Broker service allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-55697HIGHCVSS 7.8fixed in 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-55697 [HIGH] CWE-122 CVE-2025-55697: Heap-based buffer overflow in Azure Local allows an authorized attacker to elevate privileges locall Heap-based buffer overflow in Azure Local allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-55694HIGHCVSS 7.8fixed in 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-55694 [HIGH] CWE-284 CVE-2025-55694: Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileg Improper access control in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-58732HIGHCVSS 7.0≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-58732 [HIGH] CWE-416 CVE-2025-58732: Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally. Use after free in Inbox COM Objects allows an unauthorized attacker to execute code locally.
cvelistv5nvd
CVE-2025-59198MEDIUMCVSS 5.0fixed in 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-59198 [MEDIUM] CWE-20 CVE-2025-59198: Improper input validation in Microsoft Windows Search Component allows an authorized attacker to den Improper input validation in Microsoft Windows Search Component allows an authorized attacker to deny service locally.
cvelistv5nvd
CVE-2025-59259MEDIUMCVSS 6.5≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-59259 [MEDIUM] CWE-1287 CVE-2025-59259: Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an auth Improper validation of specified type of input in Windows Local Session Manager (LSM) allows an authorized attacker to deny service over a network.
cvelistv5nvd
CVE-2025-58739MEDIUMCVSS 6.5≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-58739 [MEDIUM] CWE-200 CVE-2025-58739: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauth Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
cvelistv5nvd
CVE-2025-55332MEDIUMCVSS 4.6fixed in 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-55332 [MEDIUM] CWE-841 CVE-2025-55332: Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to Improper enforcement of behavioral workflow in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
cvelistv5nvd
CVE-2025-55333MEDIUMCVSS 4.6fixed in 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-55333 [MEDIUM] CWE-1023 CVE-2025-55333: Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to b Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
cvelistv5nvd
CVE-2025-59184MEDIUMCVSS 5.5≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-59184 [MEDIUM] CWE-200 CVE-2025-59184: Exposure of sensitive information to an unauthorized actor in Windows High Availability Services all Exposure of sensitive information to an unauthorized actor in Windows High Availability Services allows an authorized attacker to disclose information locally.
cvelistv5nvd
CVE-2025-59209MEDIUMCVSS 5.5≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-59209 [MEDIUM] CWE-200 CVE-2025-59209: Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally.
cvelistv5nvd
CVE-2025-55700MEDIUMCVSS 4.3≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-55700 [MEDIUM] CWE-125 CVE-2025-55700: Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attack Out-of-bounds read in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to disclose information over a network.
cvelistv5nvd
CVE-2025-59260MEDIUMCVSS 5.5≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-59260 [MEDIUM] CWE-200 CVE-2025-59260: Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Dri Exposure of sensitive information to an unauthorized actor in Microsoft Failover Cluster Virtual Driver allows an authorized attacker to disclose information locally.
cvelistv5nvd
CVE-2025-59185MEDIUMCVSS 6.5≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-59185 [MEDIUM] CWE-73 CVE-2025-59185: External control of file name or path in Windows Core Shell allows an unauthorized attacker to perfo External control of file name or path in Windows Core Shell allows an unauthorized attacker to perform spoofing over a network.
cvelistv5nvd
CVE-2025-59211MEDIUMCVSS 5.5≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-59211 [MEDIUM] CWE-200 CVE-2025-59211: Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows Exposure of sensitive information to an unauthorized actor in Windows Push Notification Core allows an authorized attacker to disclose information locally.
cvelistv5nvd
CVE-2025-58719MEDIUMCVSS 4.7fixed in 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-58719 [MEDIUM] CWE-416 CVE-2025-58719: Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to eleva Use after free in Connected Devices Platform Service (Cdpsvc) allows an authorized attacker to elevate privileges locally.
cvelistv5nvd
CVE-2025-55679MEDIUMCVSS 4.7fixed in 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-55679 [MEDIUM] CWE-20 CVE-2025-55679: Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information Improper input validation in Windows Kernel allows an unauthorized attacker to disclose information locally.
cvelistv5nvd
CVE-2025-59203MEDIUMCVSS 5.5≤ 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-59203 [MEDIUM] CWE-532 CVE-2025-59203: Insertion of sensitive information into log file in Windows StateRepository API allows an authorized Insertion of sensitive information into log file in Windows StateRepository API allows an authorized attacker to disclose information locally.
cvelistv5nvd
← Previous22 / 58Next →