Windows Server Vulnerabilities & Security Advisories
2401 advisories tracked · Microsoft Security Update Guide (MSRC) · 64 listed in the CISA Known Exploited Vulnerabilities catalog
Every row below is a published Microsoft Server advisory that VulniPulse classified as Windows Server, with the CVEs, affected and fixed releases and exploitation status the vendor stated. Severity mix: 112 critical, 1675 high, 723 medium, 6 low.
Source
Microsoft Security Update Guide (MSRC)
Polled via the official MSRC Security Update Guide RSS feed (api.msrc.microsoft.com, no credentials required), scoped to SERVER products only — Windows Server, Exchange, SQL Server, SharePoint, Hyper-V and companion server roles. Client-only CVEs (Edge, Office apps, consumer Windows) are filtered out via the monthly CVRF document's affected-product list.
Latest Windows Server advisories
Medium [CVE-2026-119905] Windows DNS Spoofing Vulnerability
Windows DNS Spoofing Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-119909] Windows Internet Information Services Denial of Service Vulnerability
Windows Internet Information Services Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-119914] Windows Setup and Deployment Elevation of Privilege Vulnerability
Windows Setup and Deployment Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-119935] Windows Kernel Elevation of Privilege Vulnerability
Windows Kernel Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-119937] Kernel Streaming Service Driver Elevation of Privilege Vulnerability
Kernel Streaming Service Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-119942] HTTP.sys Information Disclosure Vulnerability
HTTP.sys Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-119955] Windows Hyper-V Denial of Service Vulnerability
Windows Hyper-V Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-119959] Windows Hyper-V Spoofing Vulnerability
Windows Hyper-V Spoofing Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-119972] Remote Procedure Call Denial of Service Vulnerability
Remote Procedure Call Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-122162] Windows Update Stack Information Disclosure Vulnerability
Windows Update Stack Information Disclosure Vulnerability Affected product named by the advisory: Windows Server 2025.
Medium [CVE-2026-122297] Windows Kernel Transaction Manager Information Disclosure Vulnerability
Windows Kernel Transaction Manager Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-122474] Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability
Windows Security Account Manager Remote Protocol Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-84004] AMD Zen Information Disclosure Vulnerability
AMD Zen Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016; and 2 more. Affected products named by the advisory: Windows Server 2012 R2.
Medium [CVE-2026-84005] AMD Zen Information Disclosure Vulnerability
AMD Zen Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-85907] Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability
Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-88211] Graphic Fonts Information Disclosure Vulnerability
Graphic Fonts Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-88217] Windows Graphics Kernel Information Disclosure Vulnerability
Windows Graphics Kernel Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-88220] Windows Performance Counters Information Disclosure Vulnerability
Windows Performance Counters Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-88231] Windows iSCSI Information Disclosure Vulnerability
Windows iSCSI Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-88247] Windows Program Compatibility Assistant Service Information Disclosure Vulnerability
Windows Program Compatibility Assistant Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-95884] Windows Active Directory Certificate Services Information Disclosure Vulnerability
Windows Active Directory Certificate Services Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-95908] Windows Remote Desktop Client Information Disclosure Vulnerability
Windows Remote Desktop Client Information Disclosure Vulnerability Affected product named by the advisory: Windows Server 2025.
Medium [CVE-2026-95910] Windows Hyper-V Security Feature Bypass Vulnerability
Windows Hyper-V Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-95944] Windows App Readiness Service Tampering Vulnerability
Windows App Readiness Service Tampering Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-95946] Windows Graphics Kernel Information Disclosure Vulnerability
Windows Graphics Kernel Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-95977] Windows Event Viewer Information Disclosure Vulnerability
Windows Event Viewer Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-95998] Windows StateRepository API Tampering Vulnerability
Windows StateRepository API Tampering Vulnerability Affected products named by the advisory: Windows Server 2025; Windows Server 2019; Windows Server 2022.
Medium [CVE-2026-96001] Windows Bluetooth Service Information Disclosure Vulnerability
Windows Bluetooth Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96017] Role: DNS Server Denial of Service Vulnerability
Role: DNS Server Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96018] Windows AppContainer Information Disclosure Vulnerability
Windows AppContainer Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-96022] Windows Text Services Framework Information Disclosure Vulnerability
Windows Text Services Framework Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96041] Windows USB Hub Driver Information Disclosure Vulnerability
Windows USB Hub Driver Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96058] Windows Kernel Information Disclosure Vulnerability
Windows Kernel Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96059] HID class driver Information Disclosure Vulnerability
HID class driver Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96086] Windows WLAN Service Denial of Service Vulnerability
Windows WLAN Service Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96093] Windows Internet (wininet.dll) Information Disclosure Vulnerability
Windows Internet (wininet.dll) Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96101] Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability
Windows Connected User Experiences and Telemetry Information Disclosure Vulnerability Affected product named by the advisory: Windows Server 2025.
Medium [CVE-2026-96110] Windows OLE Information Disclosure Vulnerability
Windows OLE Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96137] Windows Graphics Kernel Information Disclosure Vulnerability
Windows Graphics Kernel Information Disclosure Vulnerability Affected product named by the advisory: Windows Server 2025.
Medium [CVE-2026-96150] Microsoft Windows Codecs Library Information Disclosure Vulnerability
Microsoft Windows Codecs Library Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96156] Windows Broker Infrastructure Service Information Disclosure Vulnerability
Windows Broker Infrastructure Service Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025; Windows Server 2016.
Medium [CVE-2026-96981] Windows PCI Bus Driver Elevation of Privilege Vulnerability
Windows PCI Bus Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96983] Windows DNS Denial of Service Vulnerability
Windows DNS Denial of Service Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96989] Secondary Logon Information Disclosure Vulnerability
Secondary Logon Information Disclosure Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-96992] Windows PCI Bus Driver Elevation of Privilege Vulnerability
Windows PCI Bus Driver Elevation of Privilege Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Medium [CVE-2026-97015] Windows BitLocker Security Feature Bypass Vulnerability
Windows BitLocker Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2012; Windows Server 2012 R2; Windows Server 2016; Windows Server 2019; and 2 more. Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Low [CVE-2026-113766] Windows Language Experience Service Tampering Vulnerability
Windows Language Experience Service Tampering Vulnerability Affected product named by the advisory: Windows Server 2025.
Low [CVE-2026-119883] Data Deduplication Security Feature Bypass Vulnerability
Data Deduplication Security Feature Bypass Vulnerability Affected products named by the advisory: Windows Server 2016; Windows Server 2019; Windows Server 2022; Windows Server 2025.
Critical [CVE-2026-105016] Microsoft QUIC Remote Code Execution Vulnerability
Microsoft QUIC Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2022; Windows Server 2025.
Critical [CVE-2026-97816] Microsoft OpenSSH for Windows Remote Code Execution Vulnerability
Microsoft OpenSSH for Windows Remote Code Execution Vulnerability Affected products named by the advisory: Windows Server 2019; Windows Server 2022; Windows Server 2025.
Get an email when Windows Server publishes the next one.
See Windows Server's last 90 days of advisories first. Then choose one product with live alerts free for life, or a free month of real-time alerts on everything with the severity, the fixed version and the vendor's link (card needed, then US$15/month; we email you before the first charge).
iPhone and Android apps · New on the App Store
Monitor Windows Server CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
