cbcvebase.

Microsoft Windows Server 2025 vulnerabilities

3,648 known vulnerabilities affecting microsoft/windows_server_2025.

Total CVEs
3,648
CISA KEV
42
actively exploited
Public exploits
32
Exploited in wild
50
Severity breakdown
CRITICAL131HIGH2617MEDIUM891LOW9

Vulnerabilities

Page 33 of 183
CVE-2024-49119P3HIGHCVSS 8.1fixed in 10.0.26100.2605≥ 10.0.26100.0, < 10.0.26100.26052024-12-12
CVE-2024-49119 [HIGH] CWE-843 CVE-2024-49119: Windows Remote Desktop Services Remote Code Execution Vulnerability Windows Remote Desktop Services Remote Code Execution Vulnerability
nvd
CVE-2026-69638P3HIGHCVSS 8.4fixed in 10.0.26100.33438≥ 10.0.26100.0, < 10.0.26100.334382026-09-08
CVE-2026-69638 [HIGH] CWE-122 CVE-2026-69638: Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-69479P3HIGHCVSS 8.4fixed in 10.0.26100.33438≥ 10.0.26100.0, < 10.0.26100.334382026-09-08
CVE-2026-69479 [HIGH] CWE-122 CVE-2026-69479: Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-54122P3HIGHCVSS 8.4fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-54122 [HIGH] CWE-122 CVE-2026-54122: Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally. Heap-based buffer overflow in Windows GDI+ allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-70111P3HIGHCVSS 8.1fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-70111 [HIGH] CWE-822 CVE-2026-70111: Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privilege Untrusted pointer dereference in Windows Kernel allows an unauthorized attacker to elevate privileges over a network.
nvd
CVE-2025-53720P3HIGHCVSS 8.0fixed in 10.0.26100.4851≥ 10.0.26100.0, < 10.0.26100.49462025-08-12
CVE-2025-53720 [HIGH] CWE-122 CVE-2025-53720: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
nvd
CVE-2026-25172P3HIGHCVSS 8.0fixed in 10.0.26100.32463≥ 10.0.26100.0, < 10.0.26100.325222026-03-10
CVE-2026-25172 [HIGH] CWE-122 CVE-2026-25172: Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authori Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
nvd
CVE-2026-25173P3HIGHCVSS 8.0fixed in 10.0.26100.32463≥ 10.0.26100.0, < 10.0.26100.325222026-03-10
CVE-2026-25173 [HIGH] CWE-122 CVE-2026-25173: Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authori Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
nvd
CVE-2025-50160P3HIGHCVSS 8.0fixed in 10.0.26100.4851≥ 10.0.26100.0, < 10.0.26100.49462025-08-12
CVE-2025-50160 [HIGH] CWE-122 CVE-2025-50160: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
nvd
CVE-2025-50162P3HIGHCVSS 8.0fixed in 10.0.26100.4851≥ 10.0.26100.0, < 10.0.26100.49462025-08-12
CVE-2025-50162 [HIGH] CWE-122 CVE-2025-50162: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
nvd
CVE-2025-50164P3HIGHCVSS 8.0fixed in 10.0.26100.4851≥ 10.0.26100.0, < 10.0.26100.49462025-08-12
CVE-2025-50164 [HIGH] CWE-122 CVE-2025-50164: Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
nvd
CVE-2026-42981P3HIGHCVSS 8.1fixed in 10.0.26100.32995≥ 10.0.26100.0, < 10.0.26100.329952026-06-09
CVE-2026-42981 [HIGH] CWE-191 CVE-2026-42981: Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacke Integer underflow (wrap or wraparound) in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-42974P3HIGHCVSS 8.1fixed in 10.0.26100.32995≥ 10.0.26100.0, < 10.0.26100.329952026-06-09
CVE-2026-42974 [HIGH] CWE-190 CVE-2026-42974: Integer overflow or wraparound in Windows Performance Monitor allows an unauthorized attacker to exe Integer overflow or wraparound in Windows Performance Monitor allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-26111P3HIGHCVSS 8.0fixed in 10.0.26100.32522≥ 10.0.26100.0, < 10.0.26100.325222026-03-10
CVE-2026-26111 [HIGH] CWE-122 CVE-2026-26111: Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authori Integer overflow or wraparound in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to execute code over a network.
nvd
CVE-2026-69623P3HIGHCVSS 8.0fixed in 10.0.26100.33438≥ 10.0.26100.0, < 10.0.26100.334382026-09-08
CVE-2026-69623 [HIGH] CWE-122 CVE-2026-69623: Heap-based buffer overflow in Windows HTTP Print Provider allows an authorized attacker to execute c Heap-based buffer overflow in Windows HTTP Print Provider allows an authorized attacker to execute code over a network.
nvd
CVE-2026-88173P3HIGHCVSS 8.1fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-88173 [HIGH] CWE-367 CVE-2026-88173: Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized atta Use after free in Windows Background Intelligent Transfer Service (BITS) allows an unauthorized attacker to execute code over a network.
nvd
CVE-2026-20922P3HIGHCVSS 7.8fixed in 10.0.26100.32230≥ 10.0.26100.0, < 10.0.26100.322302026-01-13
CVE-2026-20922 [HIGH] CWE-122 CVE-2026-20922: Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.
nvd
CVE-2026-69847P3HIGHCVSS 8.0fixed in 10.0.26100.33438≥ 10.0.26100.0, < 10.0.26100.334382026-09-08
CVE-2026-69847 [HIGH] CWE-122 CVE-2026-69847: Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over Heap-based buffer overflow in Windows DHCP Server allows an authorized attacker to execute code over an adjacent network.
nvd
CVE-2026-23674P3HIGHCVSS 7.5fixed in 10.0.26100.32463≥ 10.0.26100.0, < 10.0.26100.325222026-03-10
CVE-2026-23674 [HIGH] CWE-41 CVE-2026-23674: Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to b Improper resolution of path equivalence in Windows MapUrlToZone allows an unauthorized attacker to bypass a security feature over a network.
nvd
CVE-2026-70108P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-70108 [HIGH] CWE-122 CVE-2026-70108: Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevat Heap-based buffer overflow in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
nvd
← Previous33 / 183Next →
Microsoft Windows Server 2025 vulnerabilities | cvebase