Windows Server Vulnerabilities & Security Advisories
2401 advisories tracked · Microsoft Security Update Guide (MSRC) · 64 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Microsoft Server advisory that VulniPulse classified as Windows Server, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 112 critical, 1675 high, 723 medium, 6 low.
Source
Microsoft Security Update Guide (MSRC)
Polled via the official MSRC Security Update Guide RSS feed (api.msrc.microsoft.com, no credentials required), scoped to SERVER products only — Windows Server, Exchange, SQL Server, SharePoint, Hyper-V and companion server roles. Client-only CVEs (Edge, Office apps, consumer Windows) are filtered out via the monthly CVRF document's affected-product list.
Latest Windows Server advisories
Medium [CVE-2026-83657] Windows Modern Device Management (MDM) Tampering Vulnerability
Windows Modern Device Management (MDM) Tampering Vulnerability Affected product named by the advisory: Windows Server 2019.
Medium [CVE-2026-83648] Windows Active Directory Domain Services Denial of Service Vulnerability
Windows Active Directory Domain Services Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-83571] Windows Audio Service Information Disclosure Vulnerability
Windows Audio Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-83521] Windows IKE Extension Information Disclosure Vulnerability
Windows IKE Extension Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-83515] RPC Runtime Information Disclosure Vulnerability
RPC Runtime Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-83500] Windows BitLocker Security Feature Bypass Vulnerability
Windows BitLocker Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-81964] Windows Update Orchestrator Service Security Feature Bypass Vulnerability
Windows Update Orchestrator Service Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69721] Windows iSCSI Information Disclosure Vulnerability
Windows iSCSI Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-70234] Desktop Window Manager Information Disclosure Vulnerability
Desktop Window Manager Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-70195] Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability
Windows Ancillary Function Driver for WinSock Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-70119] Windows DNS Remote Code Execution Vulnerability
Windows DNS Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-70135] Windows Remote POS Driver Information Disclosure Vulnerability
Windows Remote POS Driver Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-70090] Windows Netlogon Information Disclosure Vulnerability
Windows Netlogon Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-70087] Role: DNS Server Security Feature Bypass Vulnerability
Role: DNS Server Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-70057] Windows Routing and Remote Access Service (RRAS) Security Feature Bypass Vulnerability
Windows Routing and Remote Access Service (RRAS) Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-70017] Windows Secure Kernel Mode Information Disclosure Vulnerability
Windows Secure Kernel Mode Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69979] Windows AppX Deployment Service Security Feature Bypass Vulnerability
Windows AppX Deployment Service Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69978] Microsoft Windows VMSwitch Denial of Service Vulnerability
Microsoft Windows VMSwitch Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69974] Desktop Window Manager Information Disclosure Vulnerability
Desktop Window Manager Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69973] Windows libarchive Tampering Vulnerability
Windows libarchive Tampering Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69971] Windows Kernel-Mode Drivers Information Disclosure Vulnerability
Windows Kernel-Mode Drivers Information Disclosure Vulnerability Affected product named by the advisory: Windows Server 2025.
Medium [CVE-2026-69969] Windows AppX Deployment Service Information Disclosure Vulnerability
Windows AppX Deployment Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69967] Windows Overlay Filter Information Disclosure Vulnerability
Windows Overlay Filter Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69905] Windows AppX Deployment Service Tampering Vulnerability
Windows AppX Deployment Service Tampering Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69914] Windows AppX Deployment Service Information Disclosure Vulnerability
Windows AppX Deployment Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-108466] Windows Kernel Denial of Service Vulnerability
Windows Kernel Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-108462] Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-70235] Windows Event Tracing Spoofing Vulnerability
Windows Event Tracing Spoofing Vulnerability Affected product named by the advisory: Windows Server 2025.
Advisory ADV260001 Hardening changes for ReFS volumes on removable media
ADV260001 Hardening changes for ReFS volumes on removable media Affected products named by the advisory: Windows Server 2022; Windows Server 2016; Windows Server 2025; Windows Server 2019.
Critical [CVE-2026-69595] Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability
Windows Services for NFS ONCRPC XDR Driver Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-73025] Windows iSCSI Security Feature Bypass Vulnerability
Windows iSCSI Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-73009] Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability
Windows Secure Socket Tunneling Protocol (SSTP) Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-69769] Windows HTTP Print Provider Remote Code Execution Vulnerability
Windows HTTP Print Provider Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-69824] Microsoft Standard XPS Remote Code Execution Vulnerability
Microsoft Standard XPS Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-69768] Windows RNDIS Remote Code Execution Vulnerability
Windows RNDIS Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-69715] Windows Direct Show Remote Code Execution Vulnerability
Windows Direct Show Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-69586] Microsoft Windows PDF Remote Code Execution Vulnerability
Microsoft Windows PDF Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Critical [CVE-2026-69493] Windows Event Logging Service Remote Code Execution Vulnerability
Windows Event Logging Service Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-68839] Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability
Windows USB Mass Storage Class Driver Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-77493] Windows Graphics Component Remote Code Execution Vulnerability
Windows Graphics Component Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-69579] Windows Message Queuing Remote Code Execution Vulnerability
Windows Message Queuing Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-72982] Windows Netlogon Remote Code Execution Vulnerability
Windows Netlogon Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-69496] Windows Compressed Folder Remote Code Execution Vulnerability
Windows Compressed Folder Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-69491] Microsoft DirectMusic Remote Code Execution Vulnerability
Microsoft DirectMusic Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-69431] Telnet Client Remote Code Execution Vulnerability
Telnet Client Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-69276] Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability
Microsoft UxTheme Library (uxtheme.dll) Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-84000] Microsoft Graphics Component Remote Code Execution Vulnerability
Microsoft Graphics Component Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-83997] Windows Message Queuing Remote Code Execution Vulnerability
Windows Message Queuing Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-83990] Microsoft Graphics Component Elevation of Privilege Vulnerability
Microsoft Graphics Component Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-83989] Windows Services for NFS ONCRPC XDR Driver Denial of Service Vulnerability
Windows Services for NFS ONCRPC XDR Driver Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Get an email when Windows Server publishes the next one.
See Windows Server's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Windows Server CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
