Windows Server 2025 CVE-2026-49169

Windows Internet Shortcut Files (.url) contain an external control vulnerability (CVE-2025-33053, CVSS 8.8) that enables

Windows SMB contains an improper access control vulnerability (CVE-2025-33073, CVSS 8.8) enabling authenticated attacker

Active Directory Domain Services contains an elevation of privilege vulnerability that allows authenticated domain users

Microsoft Scripting Engine contains a type confusion vulnerability allowing unauthorized remote code execution over the

Windows Task Scheduler Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is low a

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthen

Symlink following (CWE-59) in the Windows Update Stack enables a locally authenticated attacker with standard user privi

Local privilege escalation in Microsoft Active Directory Federation Services (AD FS) lets an already-authenticated low-p

A security feature bypass in Microsoft Management Console (MMC) allows attackers to evade security warnings and execute

Privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows a locally authenticated attac

Windows CLFS Driver contains an input validation flaw enabling local privilege escalation, yet another CLFS kernel vulne

Windows Ancillary Function Driver for WinSock contains a heap-based buffer overflow enabling local privilege escalation