cbcvebase.

Microsoft Windows Server 2025 vulnerabilities

1,706 known vulnerabilities affecting microsoft/windows_server_2025.

Total CVEs
1,706
CISA KEV
38
actively exploited
Public exploits
32
Exploited in wild
47
Severity breakdown
CRITICAL40HIGH1216MEDIUM441LOW9

Vulnerabilities

Page 84 of 86
CVE-2026-20828P4MEDIUMCVSS 4.6fixed in 10.0.26100.32230≥ 10.0.26100.0, < 10.0.26100.322302026-01-13
CVE-2026-20828 [MEDIUM] CWE-125 CVE-2026-20828: Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to d Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical attack.
nvd
CVE-2025-59294P4MEDIUMCVSS 4.6fixed in 10.0.26100.6899≥ 10.0.26100.0, < 10.0.26100.68992025-10-14
CVE-2025-59294 [MEDIUM] CWE-200 CVE-2025-59294: Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unautho Exposure of sensitive information to an unauthorized actor in Windows Taskbar Live allows an unauthorized attacker to disclose information with a physical attack.
nvd
CVE-2026-58528P4MEDIUMCVSS 4.6fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-58528 [MEDIUM] CWE-125 CVE-2026-58528: Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.
nvd
CVE-2026-50453P4MEDIUMCVSS 4.6fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50453 [MEDIUM] CWE-125 CVE-2026-50453: Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.
nvd
CVE-2026-49794P4MEDIUMCVSS 4.6fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-49794 [MEDIUM] CWE-125 CVE-2026-49794: Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker Out-of-bounds read in Windows USB Audio Class driver (usbaudio.sys) allows an unauthorized attacker to disclose information with a physical attack.
nvd
CVE-2025-21278P4MEDIUMCVSS 5.5fixed in 10.0.26100.2894≥ 10.0.26100.0, < 10.0.26100.28942025-01-14
CVE-2025-21278 [MEDIUM] CWE-362 CVE-2025-21278: Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
nvd
CVE-2025-21274P4MEDIUMCVSS 5.5fixed in 10.0.26100.2894≥ 10.0.26100.0, < 10.0.26100.28942025-01-14
CVE-2025-21274 [MEDIUM] CWE-59 CVE-2025-21274: Windows Event Tracing Denial of Service Vulnerability Windows Event Tracing Denial of Service Vulnerability
nvd
CVE-2025-21284P4MEDIUMCVSS 5.5fixed in 10.0.26100.2894≥ 10.0.26100.0, < 10.0.26100.28942025-01-14
CVE-2025-21284 [MEDIUM] CWE-20 CVE-2025-21284: Windows Virtual Trusted Platform Module Denial of Service Vulnerability Windows Virtual Trusted Platform Module Denial of Service Vulnerability
nvd
CVE-2025-21280P4MEDIUMCVSS 5.5fixed in 10.0.26100.2894≥ 10.0.26100.0, < 10.0.26100.28942025-01-14
CVE-2025-21280 [MEDIUM] CWE-20 CVE-2025-21280: Windows Virtual Trusted Platform Module Denial of Service Vulnerability Windows Virtual Trusted Platform Module Denial of Service Vulnerability
nvd
CVE-2025-47969P4MEDIUMCVSS 4.4fixed in 10.0.26100.3981≥ 10.0.26100.0, < 10.0.26100.40612025-06-10
CVE-2025-47969 [MEDIUM] CWE-200 CVE-2025-47969: Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized att Exposure of sensitive information to an unauthorized actor in Windows Hello allows an authorized attacker to disclose information locally.
nvd
CVE-2026-20936P4MEDIUMCVSS 4.3fixed in 10.0.26100.32230≥ 10.0.26100.0, < 10.0.26100.322302026-01-13
CVE-2026-20936 [MEDIUM] CWE-125 CVE-2026-20936: Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a phys Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack.
nvd
CVE-2025-49760P4LOWCVSS 3.5fixed in 10.0.26100.4652≥ 10.0.26100.0, < 10.0.26100.46522025-07-08
CVE-2025-49760 [LOW] CWE-73 CVE-2025-49760: External control of file name or path in Windows Storage allows an authorized attacker to perform sp External control of file name or path in Windows Storage allows an authorized attacker to perform spoofing over a network.
nvd
CVE-2024-49098P4MEDIUMCVSS 4.3fixed in 10.0.26100.2605≥ 10.0.26100.0, < 10.0.26100.26052024-12-12
CVE-2024-49098 [MEDIUM] CWE-125 CVE-2024-49098: Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability
nvd
CVE-2024-49099P4MEDIUMCVSS 4.3fixed in 10.0.26100.2605≥ 10.0.26100.0, < 10.0.26100.26052024-12-12
CVE-2024-49099 [MEDIUM] CWE-125 CVE-2024-49099: Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability
nvd
CVE-2024-49103P4MEDIUMCVSS 4.3fixed in 10.0.26100.2605≥ 10.0.26100.0, < 10.0.26100.26052024-12-12
CVE-2024-49103 [MEDIUM] CWE-125 CVE-2024-49103: Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability
nvd
CVE-2025-24055P4MEDIUMCVSS 4.3fixed in 10.0.26100.3403fixed in 10.0.26100.3476+1 more2025-03-11
CVE-2025-24055 [MEDIUM] CWE-125 CVE-2025-24055: Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information Out-of-bounds read in Windows USB Video Driver allows an authorized attacker to disclose information with a physical attack.
nvd
CVE-2024-49087P4MEDIUMCVSS 4.6fixed in 10.0.26100.2605≥ 10.0.26100.0, < 10.0.26100.26052024-12-12
CVE-2024-49087 [MEDIUM] CWE-20 CVE-2024-49087: Windows Mobile Broadband Driver Information Disclosure Vulnerability Windows Mobile Broadband Driver Information Disclosure Vulnerability
nvd
CVE-2025-24997P4MEDIUMCVSS 4.4fixed in 10.0.26100.3403≥ 10.0.26100.0, < 10.0.26100.34762025-03-11
CVE-2025-24997 [MEDIUM] CWE-476 CVE-2025-24997: Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service loca Null pointer dereference in Windows Kernel Memory allows an authorized attacker to deny service locally.
nvd
CVE-2025-21298CRITICALCVSS 9.8≥ 10.0.26100.0, < 10.0.26100.28942025-01-14
CVE-2025-21298 [CRITICAL] CWE-416 Windows OLE Remote Code Execution Vulnerability Windows OLE Remote Code Execution Vulnerability Windows OLE Remote Code Execution Vulnerability
cvelistv5
CVE-2025-29839P4MEDIUMCVSS 4.0fixed in 10.0.26100.4061≥ 10.0.26100.0, < 10.0.26100.40612025-05-13
CVE-2025-29839 [MEDIUM] CWE-125 CVE-2025-29839: Out-of-bounds read in Windows File Server allows an unauthorized attacker to disclose information lo Out-of-bounds read in Windows File Server allows an unauthorized attacker to disclose information locally.
nvd
← Previous84 / 86Next →
Microsoft Windows Server 2025 vulnerabilities | cvebase