Windows Server Vulnerabilities & Security Advisories
2401 advisories tracked · Microsoft Security Update Guide (MSRC) · 64 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Microsoft Server advisory that VulniPulse classified as Windows Server, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 112 critical, 1675 high, 723 medium, 6 low.
Source
Microsoft Security Update Guide (MSRC)
Polled via the official MSRC Security Update Guide RSS feed (api.msrc.microsoft.com, no credentials required), scoped to SERVER products only — Windows Server, Exchange, SQL Server, SharePoint, Hyper-V and companion server roles. Client-only CVEs (Edge, Office apps, consumer Windows) are filtered out via the monthly CVRF document's affected-product list.
Latest Windows Server advisories
High [CVE-2026-70278] Microsoft Windows Media Foundation Elevation of Privilege Vulnerability
Microsoft Windows Media Foundation Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70252] Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability
Virtual Hard Disk (VHD) Miniport Driver Elevation of Privilege Vulernability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70223] Windows Console Driver Elevation of Privilege Vulnerability
Windows Console Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70247] HTTP.sys Remote Code Execution Vulnerability
HTTP.sys Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70169] Windows Connected Devices Platform Service Elevation of Privilege Vulnerability
Windows Connected Devices Platform Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-70133] Windows SMB Server Denial of Service Vulnerability
Windows SMB Server Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70155] Windows DNS Denial of Service Vulnerability
Windows DNS Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70138] Windows OLE Elevation of Privilege Vulnerability
Windows OLE Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70126] Windows Bluetooth Port Driver Remote Code Execution
Windows Bluetooth Port Driver Remote Code Execution Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 1 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70132] Windows Portable Device File System Driver Elevation of Privilege Vulnerability
Windows Portable Device File System Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70123] Microsoft Graphics Component Elevation of Privilege Vulnerability
Microsoft Graphics Component Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70139] Windows Update Service Elevation of Privilege Vulnerability
Windows Update Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70093] Windows Rich Text Edit Control Elevation of Privilege Vulnerability
Windows Rich Text Edit Control Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70056] Windows Update Service Elevation of Privilege Vulnerability
Windows Update Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-70033] Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70026] Windows Secure Kernel Mode Elevation of Privilege Vulnerability
Windows Secure Kernel Mode Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-70014] Windows Cryptographic Services Remote Code Execution Vulnerability
Windows Cryptographic Services Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-70010] Windows NTFS Elevation of Privilege Vulnerability
Windows NTFS Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
High [CVE-2026-69970] Kernel Streaming Service Driver Elevation of Privilege Vulnerability
Kernel Streaming Service Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
High [CVE-2026-69964] Kernel Streaming Service Driver Elevation of Privilege Vulnerability
Kernel Streaming Service Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-69959] Windows Overlay Filter Remote Code Execution Vulnerability
Windows Overlay Filter Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-69945] Windows AppX Deployment Extensions Elevation of Privilege Vulnerability
Windows AppX Deployment Extensions Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-69942] Windows Overlay Filter Remote Code Execution Vulnerability
Windows Overlay Filter Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-69913] Windows TCP/IP Remote Code Execution Vulnerability
Windows TCP/IP Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-69909] Microsoft COM for Windows Elevation of Privilege Vulnerability
Microsoft COM for Windows Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-69850] Windows Certificates Elevation of Privilege Vulnerability
Windows Certificates Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 1 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-69840] Windows Certificates Elevation of Privilege Vulnerability
Windows Certificates Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
High [CVE-2026-69867] SQLite Elevation of Privilege Vulnerability
SQLite Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
High [CVE-2026-69795] Windows Clipboard Server Elevation of Privilege Vulnerability
Windows Clipboard Server Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-61931] Windows Perception Simulation Service Elevation of Privilege Vulnerability
Windows Perception Simulation Service Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2019.
High [CVE-2026-70566] Windows Schannel Elevation of Privilege Vulnerability
Windows Schannel Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-49785] UEFI Secure Boot Security Feature Bypass Vulnerability
UEFI Secure Boot Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-108460] Windows Message Queuing Remote Code Execution Vulnerability
Windows Message Queuing Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-108465] Windows Update Delivery Optimization Elevation of Privilege Vulnerability
Windows Update Delivery Optimization Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-108464] Software Protection Platform (SPP) Elevation of Privilege Vulnerability
Software Protection Platform (SPP) Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-105723] Windows Distributed File System (DFS) Elevation of Privilege Vulnerability
Windows Distributed File System (DFS) Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-108458] Remote Desktop Client Remote Code Execution Vulnerability
Remote Desktop Client Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2025; Windows Server 2019; Windows Server 2012 R2; Windows Server 2012; and 2 more. Affected products named by the advisory: Windows Server 2016; Windows Server 2022.
High [CVE-2026-102227] Windows Resilient File System (ReFS) Remote Code Execution Vulnerability
Windows Resilient File System (ReFS) Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025; Windows Server 2016; Windows Server 2019.
High [CVE-2026-108457] Microsoft Windows PDF Remote Code Execution Vulnerability
Microsoft Windows PDF Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-108398] .NET Framework Security Feature Bypass Vulnerability
.NET Framework Security Feature Bypass Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft.NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft.NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft.NET Framework 3.5 AND 4.8 on Windows Server 2022; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2; Microsoft .NET Framework 4.8 on Windows Server 2012 R2.
High [CVE-2026-108400] HEVC Video Extensions Remote Code Execution Vulnerability
HEVC Video Extensions Remote Code Execution Vulnerability Affected products named by the advisory: HEVC Video Extensions from Device Manufacturer on Windows Server 2025; HEVC Video Extensions from Device Manufacturer on Windows Server 2022; HEVC Video Extensions from Device Manufacturer on Windows Server 2019.
High [CVE-2026-58280] .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022.
High [CVE-2026-69651] .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; Microsoft.NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft.NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022; Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2.
High [CVE-2026-70007] .NET Framework Remote Code Execution Vulnerability
.NET Framework Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; Microsoft.NET Framework 4.8 on Windows Server 2016; Microsoft.NET Framework 4.8 on Windows Server 2012; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 4.8 on Windows Server 2012 R2; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022; Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012.
High [CVE-2026-70035] .NET Framework Remote Code Execution Vulnerability
.NET Framework Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022.
High [CVE-2026-70174] .NET Remote Code Execution Vulnerability
.NET Remote Code Execution Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022.
High [CVE-2026-84008] .NET Denial of Service Vulnerability
.NET Denial of Service Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; Microsoft.NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022; Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2012 R2.
High [CVE-2026-85363] .NET Framework Elevation of Privilege Vulnerability
.NET Framework Elevation of Privilege Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022.
High [CVE-2026-96233] ASP.NET Core Denial of Service Vulnerability
ASP.NET Core Denial of Service Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022.
High [CVE-2026-97801] .NET Framework Tampering Vulnerability
.NET Framework Tampering Vulnerability Affected products named by the advisory: Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2025; Microsoft.NET Framework 3.5 AND 4.8.1 on Windows Server 2022; Microsoft.NET Framework 3.5 on Windows Server 2012; Microsoft.NET Framework 3.5 on Windows Server 2012 R2; and 4 more. Affected products named by the advisory: Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2016; Microsoft .NET Framework 3.5 AND 4.6.2/4.7/4.7.1/4.7.2 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2019; Microsoft .NET Framework 3.5 AND 4.8 on Windows Server 2022.
Get an email when Windows Server publishes the next one.
See Windows Server's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Windows Server CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
