Microsoft Server Windows Server Vulnerabilities & Security Advisories
1523 advisories tracked · Microsoft Security Update Guide (MSRC) · 61 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Microsoft Server advisory that VulniPulse classified as Windows Server, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 65 critical, 1087 high, 417 medium, 4 low.
Android app · Google Play
Monitor MS Server CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 32 official vendor sources and 160+ reviewed platform categories.
Source
Microsoft Security Update Guide (MSRC)
Polled via the official MSRC Security Update Guide RSS feed (api.msrc.microsoft.com, no credentials required), scoped to SERVER products only — Windows Server, Exchange, SQL Server, SharePoint, Hyper-V and companion server roles. Client-only CVEs (Edge, Office apps, consumer Windows) are filtered out via the monthly CVRF document's affected-product list.
Latest MS Server Windows Server advisories
Medium [CVE-2026-58638] Windows Boot Loader Security Feature Bypass Vulnerability
Windows Boot Loader Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-50659] .NET Spoofing Vulnerability
.NET Spoofing Vulnerability Affected products named by the advisory: Microsoft.NET Framework 4.8 on Windows Server 2016; Microsoft.NET Framework 4.8 on Windows Server 2012; Microsoft.NET Framework 4.8 on Windows Server 2012 R2; Microsoft.NET Framework 3.5 AND 4.8 on Windows Server 2019; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022; Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.7.2 on Windows Server 2016; Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012.
Medium [CVE-2026-45606] Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability
Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-45634] Windows DHCP Client Information Disclosure Vulnerability
Windows DHCP Client Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-45655] Windows BitLocker Security Feature Bypass Vulnerability
Windows BitLocker Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-50508] Windows NTLM Spoofing Vulnerability
Windows NTLM Spoofing Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server,; Windows Server 2016; Windows Server 2012; and 1 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-45594] Windows Application Identity (AppID) Information Disclosure Vulnerability
Windows Application Identity (AppID) Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-45604] Windows Managed Installer Information Disclosure Vulnerability
Windows Managed Installer Information Disclosure Vulnerability Affected product named by the advisory: Windows Server 2025.
Medium [CVE-2026-45595] Windows Mark of the Web Security Feature Bypass Vulnerability
Windows Mark of the Web Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 1 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-50507] Windows BitLocker Security Feature Bypass Vulnerability
Windows BitLocker Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 1 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-42903] Windows Kerberos Denial of Service Vulnerability
Windows Kerberos Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-42906] Windows Shell Information Disclosure Vulnerability
Windows Shell Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-42907] Windows Shell Information Disclosure Vulnerability
Windows Shell Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-42915] Microsoft Windows VMSwitch Denial of Service Vulnerability
Microsoft Windows VMSwitch Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-42968] Windows Telephony Server Information Disclosure Vulnerability
Windows Telephony Server Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-42972] Windows Hyper-V Information Disclosure Vulnerability
Windows Hyper-V Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-44805] Windows Network Controller (NC) Host Agent Denial of Service Vulnerability
Windows Network Controller (NC) Host Agent Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-45585] Windows BitLocker Security Feature Bypass Vulnerability
Microsoft is aware of a security feature bypass vulnerability in Windows publicly referred to as "YellowKey". The proof of concept for this vulnerability has been made public violating coordinated vulnerability best practices. We are issuing this CVE to provide mitigation guidance that can be implemented to protect against this vulnerability until the security update is made available. Mitigation FAQs Should I leverage the temporary mitigation? Microsoft recommends that you consider implementing these mitigations if you are concerned your devices and data are at risk of being compromised or stolen. For example, if your organization’s employees take their work devices home or on business travel. What impact to service availability/management could be caused by implementing the mitigations? Implementing these mitigations will not impact service availability or management operations. Do customers need to revert the changes made to mitigate the vulnerability once the security update to protect against this vulnerability is available? No. The security update will maintain the mitigation's behavior once the security update is installed. I am using TPM+PIN, am I at risk of this vulnerability being exploited No, if you are using TPM+PIN the vulnerability is not exploitable. Affected product named by the advisory: Windows Server 2025 (Server Core installation).
Medium [CVE-2026-41097] Secure Boot Security Feature Bypass Vulnerability
Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally. Affected products named by the advisory: Windows Server 2019; Windows Server 2019 (Server Core installation); Windows Server 2022; Windows Server 2022, 23H2 Edition (Server Core installation); and 2 more. Affected products named by the advisory: Windows Server 2025 (Server Core installation).
Medium [CVE-2026-32209] Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability
Improper access control in Windows Filtering Platform (WFP) allows an authorized attacker to bypass a security feature locally. Affected products named by the advisory: Windows Server 2012; Windows Server 2012 (Server Core installation); Windows Server 2012 R2; Windows Server 2012 R2 (Server Core installation); and 8 more. Affected products named by the advisory: Windows Server 2016 (Server Core installation); Windows Server 2019 (Server Core installation); Windows Server 2022, 23H2 Edition (Server Core installation); Windows Server 2025 (Server Core installation).