Microsoft Windows Server 2025 vulnerabilities
1,706 known vulnerabilities affecting microsoft/windows_server_2025.
Total CVEs
1,706
CISA KEV
38
actively exploited
Public exploits
32
Exploited in wild
46
Severity breakdown
CRITICAL40HIGH1216MEDIUM441LOW9
Vulnerabilities
Page 43 of 86
CVE-2026-32164P3HIGHCVSS 7.8fixed in 10.0.26100.32690≥ 10.0.26100.0, < 10.0.26100.326902026-04-14
CVE-2026-32164 [HIGH] CWE-362 CVE-2026-32164: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-32163P3HIGHCVSS 7.8fixed in 10.0.26100.32690≥ 10.0.26100.0, < 10.0.26100.326902026-04-14
CVE-2026-32163 [HIGH] CWE-362 CVE-2026-32163: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-26172P3HIGHCVSS 7.8fixed in 10.0.26100.32690≥ 10.0.26100.0, < 10.0.26100.326902026-04-14
CVE-2026-26172 [HIGH] CWE-362 CVE-2026-26172: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-27911P3HIGHCVSS 7.8fixed in 10.0.26100.32690≥ 10.0.26100.0, < 10.0.26100.326902026-04-14
CVE-2026-27911 [HIGH] CWE-362 CVE-2026-27911: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows User Interface Core allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-49787P3HIGHCVSS 7.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-49787 [HIGH] CWE-770 CVE-2026-49787: Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized atta
Allocation of resources without limits or throttling in Windows HTTP.sys allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-54119P3HIGHCVSS 7.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-54119 [HIGH] CWE-835 CVE-2026-54119: Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unautho
Loop with unreachable exit condition ('infinite loop') in Windows Active Directory allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-50161P3HIGHCVSS 7.3fixed in 10.0.26100.4851≥ 10.0.26100.0, < 10.0.26100.49462025-08-12
CVE-2025-50161 [HIGH] CWE-122 CVE-2025-50161: Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privile
Heap-based buffer overflow in Windows Win32K - GRFX allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-62565P3HIGHCVSS 7.3fixed in 10.0.26100.7392≥ 10.0.26100.0, < 10.0.26100.74622025-12-09
CVE-2025-62565 [HIGH] CWE-416 CVE-2025-62565: Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-48822P3HIGHCVSS 8.6fixed in 10.0.26100.4652≥ 10.0.26100.0, < 10.0.26100.46522025-07-08
CVE-2025-48822 [HIGH] CWE-125 CVE-2025-48822: Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
nvd
CVE-2026-50507P3MEDIUMCVSS 6.8fixed in 10.0.26100.32995≥ 10.0.26100.0, < 10.0.26100.86552026-06-09
CVE-2026-50507 [MEDIUM] CWE-306 CVE-2026-50507: Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to
Missing authentication for critical function in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
nvd
CVE-2024-49019P3HIGHCVSS 7.8fixed in 10.0.26100.2314≥ 10.0.26100.0, < 10.0.26100.23142024-11-12
CVE-2024-49019 [HIGH] CWE-1390 CVE-2024-49019: Active Directory Certificate Services Elevation of Privilege Vulnerability
Active Directory Certificate Services Elevation of Privilege Vulnerability
nvd
CVE-2025-27470P3HIGHCVSS 7.5fixed in 10.0.26100.3775≥ 10.0.26100.0, < 10.0.26100.37752025-04-08
CVE-2025-27470 [HIGH] CWE-400 CVE-2025-27470: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an un
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-26652P3HIGHCVSS 7.5fixed in 10.0.26100.3775≥ 10.0.26100.0, < 10.0.26100.37752025-04-08
CVE-2025-26652 [HIGH] CWE-400 CVE-2025-26652: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an un
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-27479P3HIGHCVSS 7.5fixed in 10.0.26100.3775≥ 10.0.26100.0, < 10.0.26100.37752025-04-08
CVE-2025-27479 [HIGH] CWE-410 CVE-2025-27479: Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over
Insufficient resource pool in Windows Kerberos allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-21174P3HIGHCVSS 7.5fixed in 10.0.26100.3775≥ 10.0.26100.0, < 10.0.26100.37752025-04-08
CVE-2025-21174 [HIGH] CWE-400 CVE-2025-21174: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an un
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-27486P3HIGHCVSS 7.5fixed in 10.0.26100.3775≥ 10.0.26100.0, < 10.0.26100.37752025-04-08
CVE-2025-27486 [HIGH] CWE-400 CVE-2025-27486: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an un
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-27485P3HIGHCVSS 7.5fixed in 10.0.26100.3775≥ 10.0.26100.0, < 10.0.26100.37752025-04-08
CVE-2025-27485 [HIGH] CWE-400 CVE-2025-27485: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an un
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-26680P3HIGHCVSS 7.5fixed in 10.0.26100.3775≥ 10.0.26100.0, < 10.0.26100.37752025-04-08
CVE-2025-26680 [HIGH] CWE-400 CVE-2025-26680: Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an un
Uncontrolled resource consumption in Windows Standards-Based Storage Management Service allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-33050P3HIGHCVSS 7.5fixed in 10.0.26100.4270≥ 10.0.26100.0, < 10.0.26100.43492025-06-10
CVE-2025-33050 [HIGH] CWE-693 CVE-2025-33050: Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service
Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-32725P3HIGHCVSS 7.5fixed in 10.0.26100.4270≥ 10.0.26100.0, < 10.0.26100.43492025-06-10
CVE-2025-32725 [HIGH] CWE-693 CVE-2025-32725: Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service
Protection mechanism failure in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
nvd