Windows Server

CVE-2026-96945 Oct 13, 19:22 HIGH PATCH Exploit Unlikely This Week

An unauthenticated attacker with network reachability to the Windows Failover Clustering service can crash the cluster communication component by provoking an uncaught exception (CWE-248), resulting in a denial of service on the affected node. Windows Server 2019, Windows Server 2022, and Windows Server 2025 - including Server Core installations - are affected only when the Failover Clustering role/feature is configured; hosts without clustering enabled are not exposed. The CVSS 3.1 base score of 7.5 (HIGH) derives entirely from availability impact over a network vector requiring no privileges or user interaction (AV:N/AC:L/PR:N/UI:N, C:N/I:N/A:H), and no public exploit code has been identified at time of analysis.

CVE-2026-85323 Oct 13, 19:20 MEDIUM PATCH This Month

Weak authentication in the Network Device Enrollment Service (NDES) component of Active Directory Certificate Services lets an authenticated, network-positioned attacker spoof the enrollment service and obtain or manipulate certificate enrollment data, with high confidentiality and integrity impact but no availability impact (CVSS 6.8, AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:N). Only Windows Server hosts on which the optional NDES role has been installed and exposed are affected - this is not a default Windows feature - and the high attack complexity means success depends on a specific condition outside the attacker's control rather than a single deterministic request. No public exploit code has been identified and the issue is not listed in CISA KEV, and a vendor patch is available from Microsoft.

CVE-2026-70005 Oct 13, 19:19 MEDIUM PATCH Exploit Unlikely This Month

Active Directory Federation Services (AD FS) on Windows Server 2019, 2022, and 2025 lets an unauthenticated network attacker bypass an authentication security feature, yielding a high integrity impact (CVSS 5.9, CWE-1390) with no credentials and no user interaction required. Exploitation depends on network reachability to the AD FS federation endpoint - which in many deployments is internet-facing - but the HIGH attack complexity (AC:H) means the attacker must also satisfy conditions outside their control, so reliable exploitation is difficult. There is no public exploit identified at time of analysis, and vendor-released patches are available for every affected build (Windows Server 2019 10.0.17763.9376, 2022 10.0.20348.5761, 2025 10.0.26100.33650 and later, including Server Core installations).

CVE-2022-29151 May 10, 21:15 HIGH PATCH This Week

Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

CVE-2022-29150 May 10, 21:15 HIGH PATCH This Week

Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

CVE-2022-29142 May 10, 21:15 HIGH PATCH This Week

Windows Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

CVE-2022-29141 May 10, 21:15 HIGH PATCH This Week

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-29140 May 10, 21:15 MEDIUM PATCH This Month

Windows Print Spooler Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

CVE-2022-29139 May 10, 21:15 HIGH PATCH This Week

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-29138 May 10, 21:15 HIGH PATCH This Week

Windows Clustered Shared Volume Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

CVE-2022-29137 May 10, 21:15 HIGH PATCH This Week

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-29135 May 10, 21:15 HIGH PATCH This Week

Windows Cluster Shared Volume (CSV) Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

CVE-2022-29134 May 10, 21:15 MEDIUM PATCH This Month

Windows Clustered Shared Volume Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity.

CVE-2022-29132 May 10, 21:15 HIGH PATCH This Week

Windows Print Spooler Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2022-29131 May 10, 21:15 HIGH PATCH This Week

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-29130 May 10, 21:15 CRITICAL PATCH Act Now

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-29129 May 10, 21:15 HIGH PATCH This Week

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-29128 May 10, 21:15 HIGH PATCH This Week

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-29127 May 10, 21:15 MEDIUM PATCH This Month

BitLocker Security Feature Bypass Vulnerability. Rated medium severity (CVSS 4.2), this vulnerability is no authentication required.

CVE-2022-29126 May 10, 21:15 HIGH PATCH This Week

Tablet Windows User Interface Application Core Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

CVE-2022-29125 May 10, 21:15 HIGH PATCH This Week

Windows Push Notifications Apps Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

CVE-2022-29123 May 10, 21:15 MEDIUM PATCH This Month

Windows Clustered Shared Volume Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity.

CVE-2022-29122 May 10, 21:15 MEDIUM PATCH This Month

Windows Clustered Shared Volume Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity.

CVE-2022-29121 May 10, 21:15 MEDIUM PATCH This Month

Windows WLAN AutoConfig Service Denial of Service Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity.

CVE-2022-29120 May 10, 21:15 MEDIUM PATCH This Month

Windows Clustered Shared Volume Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is low attack complexity.

CVE-2022-29115 May 10, 21:15 HIGH PATCH This Week

Windows Fax Service Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2022-29114 May 10, 21:15 MEDIUM PATCH This Month

Windows Print Spooler Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

CVE-2022-29113 May 10, 21:15 HIGH PATCH This Week

Windows Digital Media Receiver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8).

CVE-2022-29112 May 10, 21:15 MEDIUM PATCH This Month

Windows Graphics Component Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-29105 May 10, 21:15 HIGH PATCH This Week

Microsoft Windows Media Foundation Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2022-29104 May 10, 21:15 HIGH PATCH This Week

Windows Print Spooler Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2022-29103 May 10, 21:15 HIGH PATCH This Week

Windows Remote Access Connection Manager Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2022-29102 May 10, 21:15 MEDIUM PATCH This Month

Windows Failover Cluster Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

CVE-2022-26939 May 10, 21:15 HIGH PATCH This Week

Storage Spaces Direct Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

CVE-2022-26938 May 10, 21:15 HIGH PATCH This Week

Storage Spaces Direct Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

CVE-2022-26937 May 10, 21:15 CRITICAL PATCH Act Now

Windows Network File System Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-26936 May 10, 21:15 MEDIUM PATCH This Month

Windows Server Service Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-26935 May 10, 21:15 MEDIUM PATCH This Month

Windows WLAN AutoConfig Service Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is no authentication required, low attack complexity.

CVE-2022-26934 May 10, 21:15 MEDIUM PATCH This Month

Windows Graphics Component Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, no authentication required, low attack complexity. Epss exploitation probability 17.4%.

CVE-2022-26933 May 10, 21:15 MEDIUM PATCH This Month

Windows NTFS Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

CVE-2022-26932 May 10, 21:15 HIGH PATCH This Week

Storage Spaces Direct Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.2), this vulnerability is low attack complexity.

CVE-2022-26931 May 10, 21:15 HIGH PATCH This Week

Windows Kerberos Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable.

CVE-2022-26930 May 10, 21:15 MEDIUM PATCH This Month

Windows Remote Access Connection Manager Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

CVE-2022-26927 May 10, 21:15 HIGH PATCH This Week

Windows Graphics Component Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-26926 May 10, 21:15 HIGH PATCH This Week

Windows Address Book Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is no authentication required, low attack complexity.

CVE-2022-26913 May 10, 21:15 HIGH PATCH This Week

Windows Authentication Information Disclosure Vulnerability. Rated high severity (CVSS 7.4), this vulnerability is remotely exploitable, no authentication required.

CVE-2022-23270 May 10, 21:15 HIGH PATCH This Week

Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.

CVE-2022-22713 May 10, 21:15 MEDIUM PATCH This Month

Windows Hyper-V Denial of Service Vulnerability. Rated medium severity (CVSS 5.6).

CVE-2022-22019 May 10, 21:15 HIGH PATCH This Week

Remote Procedure Call Runtime Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-22016 May 10, 21:15 HIGH PATCH This Week

Windows PlayToManager Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0).

CVE-2022-22015 May 10, 21:15 MEDIUM PATCH This Month

Windows Remote Desktop Protocol (RDP) Information Disclosure Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-22014 May 10, 21:15 HIGH PATCH This Week

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-22013 May 10, 21:15 HIGH PATCH This Week

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity.

CVE-2022-22012 May 10, 21:15 CRITICAL PATCH Act Now

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability. Rated critical severity (CVSS 9.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity.

CVE-2022-22011 May 10, 21:15 MEDIUM PATCH This Month

Windows Graphics Component Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity.

CVE-2022-21972 May 10, 21:15 HIGH PATCH This Week

Windows Point-to-Point Tunneling Protocol Remote Code Execution Vulnerability. Rated high severity (CVSS 8.1), this vulnerability is remotely exploitable, no authentication required.

CVE-2022-24537 Apr 15, 19:15 HIGH This Week

Windows Hyper-V Remote Code Execution Vulnerability. Rated high severity (CVSS 7.8). No vendor patch available.

CVE-2022-24525 Mar 09, 17:15 HIGH This Week

Windows Update Stack Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0). No vendor patch available.

CVE-2022-24508 Mar 09, 17:15 HIGH This Week

Win32 File Enumeration Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-24507 Mar 09, 17:15 HIGH This Week

Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2022-24505 Mar 09, 17:15 HIGH This Week

Windows ALPC Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0). No vendor patch available.

CVE-2022-24503 Mar 09, 17:15 MEDIUM This Month

Remote Desktop Protocol Client Information Disclosure Vulnerability. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-24502 Mar 09, 17:15 MEDIUM This Month

Windows HTML Platforms Security Feature Bypass Vulnerability. Rated medium severity (CVSS 4.3), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-24460 Mar 09, 17:15 HIGH This Week

Tablet Windows User Interface Application Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0), this vulnerability is no authentication required. No vendor patch available.

CVE-2022-24459 Mar 09, 17:15 HIGH This Week

Windows Fax and Scan Service Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2022-24454 Mar 09, 17:15 HIGH This Week

Windows Security Support Provider Interface Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2022-23299 Mar 09, 17:15 HIGH This Week

Windows PDEV Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2022-23298 Mar 09, 17:15 HIGH This Week

Windows NT OS Kernel Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0). No vendor patch available.

CVE-2022-23297 Mar 09, 17:15 MEDIUM This Month

Windows NT Lan Manager Datagram Receiver Driver Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2022-23296 Mar 09, 17:15 HIGH This Week

Windows Installer Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2022-23294 Mar 09, 17:15 HIGH This Week

Windows Event Tracing Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-23293 Mar 09, 17:15 HIGH This Week

Windows Fast FAT File System Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2022-23291 Mar 09, 17:15 HIGH This Week

Windows DWM Core Library Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2022-23290 Mar 09, 17:15 HIGH This Week

Windows Inking COM Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. No vendor patch available.

CVE-2022-23288 Mar 09, 17:15 HIGH This Week

Windows DWM Core Library Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0). No vendor patch available.

CVE-2022-23287 Mar 09, 17:15 HIGH This Week

Windows ALPC Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0). No vendor patch available.

CVE-2022-23286 Mar 09, 17:15 HIGH This Week

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0). No vendor patch available.

CVE-2022-23285 Mar 09, 17:15 HIGH This Week

Remote Desktop Client Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-23284 Mar 09, 17:15 HIGH This Week

Windows Print Spooler Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-23283 Mar 09, 17:15 HIGH This Week

Windows ALPC Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.0). No vendor patch available.

CVE-2022-23281 Mar 09, 17:15 MEDIUM This Month

Windows Common Log File System Driver Information Disclosure Vulnerability. Rated medium severity (CVSS 5.5), this vulnerability is low attack complexity. No vendor patch available.

CVE-2022-23253 Mar 09, 17:15 MEDIUM This Month

Windows Point-to-Point Tunneling Protocol Denial of Service Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely exploitable, low attack complexity. No vendor patch available.

CVE-2022-22010 Mar 09, 17:15 MEDIUM This Month

Media Foundation Information Disclosure Vulnerability. Rated medium severity (CVSS 4.4), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2022-21990 Mar 09, 17:15 HIGH This Week

Remote Desktop Client Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, no authentication required, low attack complexity. No vendor patch available.

CVE-2022-21977 Mar 09, 17:15 LOW Monitor

Media Foundation Information Disclosure Vulnerability. Rated low severity (CVSS 3.3), this vulnerability is no authentication required, low attack complexity. No vendor patch available.

CVE-2022-21975 Mar 09, 17:15 MEDIUM This Month

Windows Hyper-V Denial of Service Vulnerability. Rated medium severity (CVSS 4.7). No vendor patch available.

CVE-2021-43893 Dec 15, 15:15 HIGH PATCH This Week

Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.5), this vulnerability is remotely exploitable. This Exposure of Resource to Wrong Sphere vulnerability could allow attackers to access resources from an unintended security context.

CVE-2021-43883 Dec 15, 15:15 HIGH PATCH This Week

Windows Installer Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2021-43248 Dec 15, 15:15 HIGH PATCH This Week

Windows Digital Media Receiver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity.

CVE-2021-43247 Dec 15, 15:15 HIGH PATCH This Week

Windows TCP/IP Driver Elevation of Privilege Vulnerability. Rated high severity (CVSS 7.8), this vulnerability is low attack complexity. This Out-of-bounds Write vulnerability could allow attackers to write data beyond allocated buffer boundaries leading to code execution or crashes.