Windows Server Vulnerabilities & Security Advisories
2401 advisories tracked · Microsoft Security Update Guide (MSRC) · 64 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Microsoft Server advisory that VulniPulse classified as Windows Server, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 112 critical, 1675 high, 723 medium, 6 low.
Source
Microsoft Security Update Guide (MSRC)
Polled via the official MSRC Security Update Guide RSS feed (api.msrc.microsoft.com, no credentials required), scoped to SERVER products only — Windows Server, Exchange, SQL Server, SharePoint, Hyper-V and companion server roles. Client-only CVEs (Edge, Office apps, consumer Windows) are filtered out via the monthly CVRF document's affected-product list.
Latest Windows Server advisories
High [CVE-2026-119859] Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability
Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2025.
High [CVE-2026-119860] Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability
Windows Internet Connection Sharing (ICS) Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
High [CVE-2026-119862] Windows Input System Elevation of Privilege Vulnerability
Windows Input System Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119866] Windows Device Association Service Elevation of Privilege Vulnerability
Windows Device Association Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-119876] Windows USB Scanner Driver Elevation of Privilege Vulnerability
Windows USB Scanner Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119880] Microsoft XPS Document Converter Remote Code Execution Vulnerability
Microsoft XPS Document Converter Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119881] Microsoft XPS Document Converter Elevation of Privilege Vulnerability
Microsoft XPS Document Converter Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119893] Windows Audio Service Elevation of Privilege Vulnerability
Windows Audio Service Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2025.
High [CVE-2026-119898] Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-119903] Windows Installer Elevation of Privilege Vulnerability
Windows Installer Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025; Windows Server 2016; Windows Server 2019.
High [CVE-2026-119904] Microsoft Windows Speech Elevation of Privilege Vulnerability
Microsoft Windows Speech Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119907] Windows Function Discovery Resource Publication Elevation of Privilege Vulnerability
Windows Function Discovery Resource Publication Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119908] Windows Storage Spaces Controller Remote Code Execution Vulnerability
Windows Storage Spaces Controller Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-119917] Windows Distributed Transaction Coordinator Elevation of Privilege Vulnerability
Windows Distributed Transaction Coordinator Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119925] Windows Text Services Framework Elevation of Privilege Vulnerability
Windows Text Services Framework Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119928] Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability
Windows PrintWorkflowUserSvc Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119932] Windows Remote Desktop Denial of Service Vulnerability
Windows Remote Desktop Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119938] Windows Shell Remote Code Execution Vulnerability
Windows Shell Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119943] Microsoft Windows Search Component Elevation of Privilege Vulnerability
Microsoft Windows Search Component Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2025.
High [CVE-2026-119944] Windows Mobile Device Management Elevation of Privilege Vulnerability
Windows Mobile Device Management Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119945] Windows Modern Device Management (MDM) Remote Code Execution Vulnerability
Windows Modern Device Management (MDM) Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-119947] Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
High [CVE-2026-119948] Windows Active Directory Remote Code Execution Vulnerability
Windows Active Directory Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119950] Windows Print Spooler Components Elevation of Privilege Vulnerability
Windows Print Spooler Components Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2025; Windows Server 2016; Windows Server 2019; Windows Server 2022.
High [CVE-2026-119952] Windows Schannel Remote Code Execution Vulnerability
Windows Schannel Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119954] Microsoft Windows Search Component Elevation of Privilege Vulnerability
Microsoft Windows Search Component Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119957] Windows Remote Desktop Services Elevation of Privilege Vulnerability
Windows Remote Desktop Services Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119960] Windows Hyper-V Elevation of Privilege Vulnerability
Windows Hyper-V Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2025.
High [CVE-2026-119961] Windows Internet Information Services Remote Code Execution Vulnerability
Windows Internet Information Services Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119962] Windows CredSSP Remote Code Execution Vulnerability
Windows CredSSP Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119966] Windows Graphics Kernel Elevation of Privilege Vulnerability
Windows Graphics Kernel Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2025.
High [CVE-2026-119969] Graphic Fonts Remote Code Execution Vulnerability
Graphic Fonts Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119987] Microsoft Windows App Store Elevation of Privilege Vulnerability
Microsoft Windows App Store Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-119988] Windows SMB Remote Code Execution Vulnerability
Windows SMB Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-119992] Windows HTTP.sys Elevation of Privilege Vulnerability
Windows HTTP.sys Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-121671] Windows Audio Service Elevation of Privilege Vulnerability
Windows Audio Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
High [CVE-2026-121680] Windows NTLM Spoofing Vulnerability
Windows NTLM Spoofing Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-121681] Microsoft Trace Data Helper Elevation of Privilege Vulnerability
Microsoft Trace Data Helper Elevation of Privilege Vulnerability Affected product named by the advisory: Windows Server 2025.
High [CVE-2026-122163] Windows Image Acquisition Remote Code Execution Vulnerability
Windows Image Acquisition Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-122168] Microsoft Windows Media Foundation Elevation of Privilege Vulnerability
Microsoft Windows Media Foundation Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-122169] Windows IKE Extension Spoofing Vulnerability
Windows IKE Extension Spoofing Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-122172] Microsoft Trace Data Helper Elevation of Privilege Vulnerability
Microsoft Trace Data Helper Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-122177] Windows iSCSI Elevation of Privilege Vulnerability
Windows iSCSI Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-122182] Windows Maps Elevation of Privilege Vulnerability
Windows Maps Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-123388] Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability
Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-124224] PowerShell Elevation of Privilege Vulnerability
PowerShell Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-124225] Windows PowerShell Remote Code Execution Vulnerability
Windows PowerShell Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-124226] Microsoft PowerShell Security Feature Bypass Vulnerability
Microsoft PowerShell Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-125134] Windows Function Discovery Resource Publication Remote Code Execution Vulnerability
Windows Function Discovery Resource Publication Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
High [CVE-2026-125137] Windows Graphics Kernel Elevation of Privilege Vulnerability
Windows Graphics Kernel Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Get an email when Windows Server publishes the next one.
See Windows Server's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Windows Server CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
