Microsoft Windows Server 2025 vulnerabilities
3,648 known vulnerabilities affecting microsoft/windows_server_2025.
Total CVEs
3,648
CISA KEV
42
actively exploited
Public exploits
32
Exploited in wild
50
Severity breakdown
CRITICAL131HIGH2617MEDIUM891LOW9
Vulnerabilities
Page 55 of 183
CVE-2026-70155P3HIGHCVSS 7.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-70155 [HIGH] CWE-401 CVE-2026-70155: Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to
Missing release of memory after effective lifetime in Windows DNS allows an unauthorized attacker to deny service over a network.
nvd
CVE-2024-49089P3HIGHCVSS 7.2fixed in 10.0.26100.2605≥ 10.0.26100.0, < 10.0.26100.26052024-12-12
CVE-2024-49089 [HIGH] CWE-122 CVE-2024-49089: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
nvd
CVE-2026-70031P3HIGHCVSS 7.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-70031 [HIGH] CWE-122 CVE-2026-70031: Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a n
Heap-based buffer overflow in Windows iSCSI allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-83795P3HIGHCVSS 7.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83795 [HIGH] CWE-122 CVE-2026-83795: Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service
Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-73027P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-73027 [HIGH] CWE-15 CVE-2026-73027: External control of system or configuration setting in Windows Setup Files Cleanup allows an authori
External control of system or configuration setting in Windows Setup Files Cleanup allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-21246P3HIGHCVSS 7.8fixed in 10.0.26100.32313≥ 10.0.26100.0, < 10.0.26100.323702026-02-10
CVE-2026-21246 [HIGH] CWE-122 CVE-2026-21246: Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate
Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-69718P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-69718 [HIGH] CWE-77 CVE-2026-69718: Improper neutralization of special elements used in a command ('command injection') in Windows Updat
Improper neutralization of special elements used in a command ('command injection') in Windows Update allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-69588P3HIGHCVSS 7.5fixed in 10.0.26100.33438≥ 10.0.26100.0, < 10.0.26100.334382026-09-08
CVE-2026-69588 [HIGH] CWE-401 CVE-2026-69588: Missing release of memory after effective lifetime in Windows TCP/IP allows an unauthorized attacker
Missing release of memory after effective lifetime in Windows TCP/IP allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-70065P3HIGHCVSS 7.5fixed in 10.0.26100.33438≥ 10.0.26100.0, < 10.0.26100.334382026-09-08
CVE-2026-70065 [HIGH] CWE-401 CVE-2026-70065: Missing release of memory after effective lifetime in Windows DHCP Server allows an unauthorized att
Missing release of memory after effective lifetime in Windows DHCP Server allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50368P3HIGHCVSS 7.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50368 [HIGH] CWE-121 CVE-2026-50368: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50355P3HIGHCVSS 7.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50355 [HIGH] CWE-121 CVE-2026-50355: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50695P3HIGHCVSS 7.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50695 [HIGH] CWE-121 CVE-2026-50695: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50411P3HIGHCVSS 7.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50411 [HIGH] CWE-121 CVE-2026-50411: Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized a
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50304P3HIGHCVSS 7.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50304 [HIGH] CWE-121 CVE-2026-50304: Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker
Stack-based buffer overflow in Active Directory Federation Services allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-54983P3HIGHCVSS 7.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-54983 [HIGH] CWE-121 CVE-2026-54983: Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized a
Stack-based buffer overflow in Active Directory Federation Services (AD FS) allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-50696P3HIGHCVSS 7.5fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50696 [HIGH] CWE-122 CVE-2026-50696: Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized at
Heap-based buffer overflow in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.
nvd
CVE-2025-29969P3HIGHCVSS 7.5fixed in 10.0.26100.4061≥ 10.0.26100.0, < 10.0.26100.40612025-05-13
CVE-2025-29969 [HIGH] CWE-367 CVE-2025-29969: Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attac
Time-of-check time-of-use (toctou) race condition in Windows Fundamentals allows an authorized attacker to execute code over a network.
nvd
CVE-2026-96248P3HIGHCVSS 7.5fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-96248 [HIGH] CWE-121 CVE-2026-96248: Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny
Stack-based buffer overflow in Windows Host Guardian Service allows an unauthorized attacker to deny service over a network.
nvd
CVE-2026-102215P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-102215 [HIGH] CWE-122 CVE-2026-102215: Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an auth
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-102218P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-102218 [HIGH] CWE-122 CVE-2026-102218: Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an auth
Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
nvd