Windows Server Vulnerabilities & Security Advisories
2401 advisories tracked · Microsoft Security Update Guide (MSRC) · 64 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Microsoft Server advisory that VulniPulse classified as Windows Server, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 112 critical, 1675 high, 723 medium, 6 low.
Source
Microsoft Security Update Guide (MSRC)
Polled via the official MSRC Security Update Guide RSS feed (api.msrc.microsoft.com, no credentials required), scoped to SERVER products only — Windows Server, Exchange, SQL Server, SharePoint, Hyper-V and companion server roles. Client-only CVEs (Edge, Office apps, consumer Windows) are filtered out via the monthly CVRF document's affected-product list.
Latest Windows Server advisories
High [CVE-2026-96246] Network Policy Server (NPS) Information Disclosure Vulnerability
Network Policy Server (NPS) Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-96245] Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability
Windows Routing and Remote Access Service (RRAS) Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-96244] Windows Internal System User Profile Elevation of Privilege Vulnerability
Windows Internal System User Profile Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2025; Windows Server 2016; Windows Server 2019; Windows Server 2022.
High [CVE-2026-96222] Active Directory Federation Services (AD FS) Spoofing Vulnerability
Active Directory Federation Services (AD FS) Spoofing Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 4 more. Affected products named by the advisory: Windows Server 2012 R2; Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft .NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft .NET Framework 3.5 on Windows Server 2012.
High [CVE-2026-96220] Windows Assigned Access Elevation of Privilege Vulnerability
Windows Assigned Access Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2019.
High [CVE-2026-70149] Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability
Windows Client Side Caching driver (csc.sys) Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-70109] Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability
Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2025; Windows Server 2022.
High [CVE-2026-70092] Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability
Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2025; Windows Server 2022; Windows Server 2012; Windows Server 2012 R2; and 2 more. Affected products named by the advisory: Windows Server 2016; Windows Server 2019.
High [CVE-2026-70110] Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability
Microsoft PostScript Printer Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2025; and 2 more. Affected products named by the advisory: Windows Server 2019; Windows Server 2022.
High [CVE-2026-70068] Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability
Windows Client-Side Caching (CSC) Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2025; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2019; Windows Server 2022.
High [CVE-2026-70131] Microsoft Windows Media Foundation Elevation of Privilege Vulnerability
Microsoft Windows Media Foundation Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-70102] Windows Spaceport.sys Elevation of Privilege Vulnerability
Windows Spaceport.sys Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-70134] Windows Event Tracing Elevation of Privilege Vulnerability
Windows Event Tracing Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-70045] Windows Work Folders Elevation of Privilege Vulnerability
Windows Work Folders Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2025.
High [CVE-2026-70013] Windows iSCSI Remote Code Execution Vulnerability
Windows iSCSI Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2025; Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2019; Windows Server 2022.
High [CVE-2026-70031] Windows iSCSI Denial of Service Vulnerability
Windows iSCSI Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-70038] Windows iSCSI Remote Code Execution Vulnerability
Windows iSCSI Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-70008] Windows IP Over USB Service Elevation of Privilege Vulnerability
Windows IP Over USB Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-70113] Windows Client for NFS Elevation of Privilege Vulnerability
Windows Client for NFS Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-69977] Quality Windows Audio/Video Experience (QWAVE) service Elevation of Privilege Vulnerability
Quality Windows Audio/Video Experience (QWAVE) service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-69923] Windows AI Elevation of Privilege Vulnerability
Windows AI Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2025.
High [CVE-2026-88146] Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability
Windows Background Intelligent Transfer Service (BITS) Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-88136] Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability
Web Distributed Authoring and Versioning (WEBDAV) Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-88106] Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2025; Windows Server 2019; Windows Server 2022.
High [CVE-2026-88100] Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Windows Storage Spaces Controller Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2025.
High [CVE-2026-88098] Windows Security Support Provider Interface Elevation of Privilege Vulnerability
Windows Security Support Provider Interface Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-88070] Windows BitLocker Elevation of Privilege Vulnerability
Windows BitLocker Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-87716] Windows Storage Spaces Controller Denial of Service Vulnerability
Windows Storage Spaces Controller Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2025; Windows Server 2019; Windows Server 2022.
High [CVE-2026-87713] Windows Bluetooth Port Driver Remote Code Execution
Windows Bluetooth Port Driver Remote Code Execution Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-87712] Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability
Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-87710] Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability
Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-87707] Windows Fax and Scan Service Elevation of Privilege Vulnerability
Windows Fax and Scan Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2012; Windows Server 2012 R2; Windows Server 2022; and 2 more. Affected products named by the advisory: Windows Server 2025; Windows Server 2019.
High [CVE-2026-87706] Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Windows Storage Spaces Controller Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-87691] Windows Management Services Elevation of Privilege Vulnerability
Windows Management Services Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2025.
High [CVE-2026-85934] Windows AppX Deployment Service Elevation of Privilege Vulnerability
Windows AppX Deployment Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-85933] Windows Print Spooler Components Elevation of Privilege Vulnerability
Windows Print Spooler Components Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-85931] Windows Distributed File System (DFS) Remote Code Execution Vulnerability
Windows Distributed File System (DFS) Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-85930] Windows Image Acquisition Elevation of Privilege Vulnerability
Windows Image Acquisition Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-85926] Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2012; and 2 more. Affected products named by the advisory: Windows Server 2012 R2; Windows Server 2016.
High [CVE-2026-85904] Windows Device Association Service Elevation of Privilege Vulnerability
Windows Device Association Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-85867] Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
Windows Remote Access Connection Manager Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 1 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-85329] Microsoft Account Elevation of Privilege Vulnerability
Microsoft Account Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-83710] Windows Device Association Service Elevation of Privilege Vulnerability
Windows Device Association Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
High [CVE-2026-83674] Active Directory Federation Services (AD FS) Spoofing Vulnerability
Active Directory Federation Services (AD FS) Spoofing Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
High [CVE-2026-70238] Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Windows Storage Spaces Controller Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70210] Windows OLE DB Elevation of Privilege Vulnerability
Windows OLE DB Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70187] Windows Remote Desktop Services Remote Code Execution Vulnerability
Windows Remote Desktop Services Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70185] Microsoft PowerShell Security Feature Bypass Vulnerability
Microsoft PowerShell Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70167] Windows Domain Name Service Remote Code Execution Vulnerability
Windows Domain Name Service Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-70052] Microsoft PowerShell Remote Code Execution Vulnerability
Microsoft PowerShell Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Get an email when Windows Server publishes the next one.
See Windows Server's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Windows Server CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
