Microsoft Windows Server 2025 vulnerabilities
3,648 known vulnerabilities affecting microsoft/windows_server_2025.
Total CVEs
3,648
CISA KEV
42
actively exploited
Public exploits
32
Exploited in wild
50
Severity breakdown
CRITICAL131HIGH2617MEDIUM891LOW9
Vulnerabilities
Page 98 of 183
CVE-2026-23672P3HIGHCVSS 7.8fixed in 10.0.26100.32463≥ 10.0.26100.0, < 10.0.26100.325222026-03-10
CVE-2026-23672 [HIGH] CWE-125 CVE-2026-23672: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
nvd
CVE-2026-50498P3HIGHCVSS 7.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50498 [HIGH] CWE-125 CVE-2026-50498: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
nvd
CVE-2026-88126P3HIGHCVSS 7.8≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-88126 [HIGH] CWE-822 CVE-2026-88126: Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-49790P3HIGHCVSS 7.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-49790 [HIGH] CWE-122 CVE-2026-49790: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
nvd
CVE-2026-25174P3HIGHCVSS 7.8fixed in 10.0.26100.32463≥ 10.0.26100.0, < 10.0.26100.325222026-03-10
CVE-2026-25174 [HIGH] CWE-125 CVE-2026-25174: Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate pr
Out-of-bounds read in Windows Extensible File Allocation allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-55224P3HIGHCVSS 7.8fixed in 10.0.26100.6508≥ 10.0.26100.0, < 10.0.26100.65842025-09-09
CVE-2025-55224 [HIGH] CWE-362 CVE-2025-55224: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
nvd
CVE-2026-96933P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-96933 [HIGH] CWE-822 CVE-2026-96933: Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to
Untrusted pointer dereference in Windows COM+ Event System Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-96847P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-96847 [HIGH] CWE-822 CVE-2026-96847: Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
Untrusted pointer dereference in WebDAV allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-96931P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-96931 [HIGH] CWE-822 CVE-2026-96931: Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges lo
Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-83587P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83587 [HIGH] CWE-822 CVE-2026-83587: Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate pri
Untrusted pointer dereference in Windows Core Messaging allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-70177P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-70177 [HIGH] CWE-20 CVE-2026-70177: Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elev
Numeric truncation error in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-83826P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-83826 [HIGH] CWE-822 CVE-2026-83826: Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate pr
Untrusted pointer dereference in Windows Error Reporting allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-40404P3HIGHCVSS 7.8fixed in 10.0.26100.32995≥ 10.0.26100.0, < 10.0.26100.329952026-06-09
CVE-2026-40404 [HIGH] CWE-122 CVE-2026-40404: Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
nvd
CVE-2026-50441P3HIGHCVSS 7.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50441 [HIGH] CWE-822 CVE-2026-50441: Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker
Untrusted pointer dereference in Windows Resilient File System (ReFS) allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-50479P3HIGHCVSS 7.8fixed in 10.0.26100.33158≥ 10.0.26100.0, < 10.0.26100.331582026-07-14
CVE-2026-50479 [HIGH] CWE-822 CVE-2026-50479: Untrusted pointer dereference in Windows USB Hub Driver allows an authorized attacker to elevate pri
Untrusted pointer dereference in Windows USB Hub Driver allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-48000P3HIGHCVSS 7.8fixed in 10.0.26100.4652≥ 10.0.26100.0, < 10.0.26100.46522025-07-08
CVE-2025-48000 [HIGH] CWE-362 CVE-2025-48000: Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevat
Use after free in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.
nvd
CVE-2025-55228P3HIGHCVSS 7.8fixed in 10.0.26100.6508≥ 10.0.26100.0, < 10.0.26100.65842025-09-09
CVE-2025-55228 [HIGH] CWE-362 CVE-2025-55228: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Win32K - GRFX allows an authorized attacker to execute code locally.
nvd
CVE-2026-32222P3HIGHCVSS 7.8fixed in 10.0.26100.32690≥ 10.0.26100.0, < 10.0.26100.326902026-04-14
CVE-2026-32222 [HIGH] CWE-822 CVE-2026-32222: Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate pri
Untrusted pointer dereference in Windows Win32K - ICOMP allows an authorized attacker to elevate privileges locally.
nvd
CVE-2026-96953P3HIGHCVSS 7.8fixed in 10.0.26100.33650≥ 10.0.26100.0, < 10.0.26100.336502026-10-13
CVE-2026-96953 [HIGH] CWE-476 CVE-2026-96953: Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an author
Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.
nvd
CVE-2025-54913P3HIGHCVSS 7.8fixed in 10.0.26100.6508≥ 10.0.26100.0, < 10.0.26100.65842025-09-09
CVE-2025-54913 [HIGH] CWE-362 CVE-2025-54913: Concurrent execution using shared resource with improper synchronization ('race condition') in Windo
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows UI XAML Maps MapControlSettings allows an authorized attacker to elevate privileges locally.
nvd