Windows Server Vulnerabilities & Security Advisories
2401 advisories tracked · Microsoft Security Update Guide (MSRC) · 64 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Microsoft Server advisory that VulniPulse classified as Windows Server, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 112 critical, 1675 high, 723 medium, 6 low.
Source
Microsoft Security Update Guide (MSRC)
Polled via the official MSRC Security Update Guide RSS feed (api.msrc.microsoft.com, no credentials required), scoped to SERVER products only — Windows Server, Exchange, SQL Server, SharePoint, Hyper-V and companion server roles. Client-only CVEs (Edge, Office apps, consumer Windows) are filtered out via the monthly CVRF document's affected-product list.
Latest Windows Server advisories
Medium [CVE-2026-69453] Microsoft Windows Search Component Tampering Vulnerability
Microsoft Windows Search Component Tampering Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69449] Windows BitLocker Remote Code Execution Vulnerability
Windows BitLocker Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69393] Windows Spaceport.sys Information Disclosure Vulnerability
Windows Spaceport.sys Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-69374] Windows SMB Server Denial of Service Vulnerability
Windows SMB Server Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69403] Windows SMB Server Information Disclosure Vulnerability
Windows SMB Server Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-69372] Windows Network File System Denial of Service Vulnerability
Windows Network File System Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69376] Microsoft Standard XPS Information Disclosure Vulnerability
Microsoft Standard XPS Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69353] Windows Text Shaping Information Disclosure Vulnerability
Windows Text Shaping Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69344] Windows Print Spooler Components Information Disclosure Vulnerability
Windows Print Spooler Components Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69351] Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability
Windows Universal Plug and Play (UPnP) Device Host Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69316] Windows Overlay Filter Information Disclosure Vulnerability
Windows Overlay Filter Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-69318] Windows Imaging Component Information Disclosure Vulnerability
Windows Imaging Component Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69315] Windows License Manager Information Disclosure Vulnerability
Windows License Manager Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69303] Push Message Routing Service Information Disclosure Vulnerability
Push Message Routing Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-69321] Windows Power Dependency Coordinator Tampering Vulnerability
Windows Power Dependency Coordinator Tampering Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69294] Microsoft COM for Windows Information Disclosure Vulnerability
Microsoft COM for Windows Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69286] Windows USB Audio Class Driver Information Disclosure Vulnerability
Windows USB Audio Class Driver Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-68895] Internet Storage Name Service Information Disclosure Vulnerability
Internet Storage Name Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-68886] Windows Network Connection Broker Information Disclosure Vulnerability
Windows Network Connection Broker Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-68898] Windows iSCSI Denial of Service Vulnerability
Windows iSCSI Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-68873] Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
Windows Program Compatibility Assistant Service Information Disclosure Vulnerability Affected product named by the advisory: Windows Server 2025.
Medium [CVE-2026-68852] Microsoft Account Information Disclosure Vulnerability
Microsoft Account Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-68874] Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
Windows Program Compatibility Assistant Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-68843] Microsoft Office Word Information Disclosure Vulnerability
Use after free in Microsoft Office Word allows an authorized attacker to disclose information locally. Affected products named by the advisory: Windows Server 2012; Windows Server 2012 (Server Core installation); Windows Server 2012 R2; Windows Server 2012 R2 (Server Core installation); and 7 more. Affected products named by the advisory: Windows Server 2016 (Server Core installation); Windows Server 2019 (Server Core installation); Windows Server 2022; Windows Server 2025 (Server Core installation).
Medium [CVE-2026-68831] Windows Defender Firewall Service Information Disclosure Vulnerability
Windows Defender Firewall Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-83991] Windows Cloud Files Mini Filter Driver Tampering Vulnerability
Windows Cloud Files Mini Filter Driver Tampering Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-70019] Windows Compressed Folder Information Disclosure Vulnerability
Windows Compressed Folder Information Disclosure Vulnerability Affected product named by the advisory: Windows Server 2025.
Medium [CVE-2026-78523] Windows DNS Server Denial of Service Vulnerability
Windows DNS Server Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-77896] Windows Remote Desktop Client Denial of Service Vulnerability
Windows Remote Desktop Client Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-77892] Windows Boot Manager Elevation of Privilege Vulnerability
Windows Boot Manager Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-72980] Windows Hello Security Feature Bypass Vulnerability
Uncontrolled search path element in Windows Hello allows an authorized attacker to bypass a security feature locally. Affected products named by the advisory: Windows Server 2016; Windows Server 2016 (Server Core installation); Windows Server 2019; Windows Server 2019 (Server Core installation); and 3 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025 (Server Core installation).
Medium [CVE-2026-69548] Windows RNDIS Information Disclosure Vulnerability
Windows RNDIS Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69469] Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability
Windows USB Audio Class driver (usbaudio.sys) Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-72945] Windows Task Scheduler Information Disclosure Vulnerability
Windows Task Scheduler Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2016.
Medium [CVE-2026-71341] Windows Partition Management Driver Information Disclosure Vulnerability
Windows Partition Management Driver Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-71338] Windows Failover Cluster Elevation of Privilege Vulnerability
Windows Failover Cluster Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69839] Windows iSCSI Target Service Denial of Service Vulnerability
Windows iSCSI Target Service Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69862] Windows Wireless Wide Area Network Service Information Disclosure Vulnerability
Windows Wireless Wide Area Network Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2016.
Medium [CVE-2026-69741] Windows Spaceport.sys Information Disclosure Vulnerability
Windows Spaceport.sys Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69627] Windows Remote Desktop Licensing Service Information Disclosure Vulnerability
Windows Remote Desktop Licensing Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69684] Windows Error Reporting Information Disclosure Vulnerability
Windows Error Reporting Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 1 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69527] Windows USB Mass Storage Class Driver Information Disclosure Vulnerability
Windows USB Mass Storage Class Driver Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69507] Microsoft Windows Search Component Information Disclosure Vulnerability
Microsoft Windows Search Component Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-69531] Microsoft Windows Speech Tampering Vulnerability
Microsoft Windows Speech Tampering Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-69349] Windows Management Instrumentation Information Disclosure Vulnerability
Windows Management Instrumentation Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-69267] Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability
Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-68849] Windows Bluetooth Port Driver Information Disclosure Vulnerability
Windows Bluetooth Port Driver Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Critical [CVE-2026-65791] Windows iSCSI Target Service Remote Code Execution Vulnerability
Windows iSCSI Target Service Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Critical [CVE-2026-62893] Windows Deployment Services TFTP Server Remote Code Execution Vulnerability
Windows Deployment Services TFTP Server Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
High [CVE-2026-71331] Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability
Windows Device Health Attestation (DHA) Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Get an email when Windows Server publishes the next one.
See Windows Server's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Windows Server CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
