Windows Server 2022 23H2 Edition Server Core Installation

Windows Secure Boot bypass across Windows 10 version 1809 through Windows 11 version 26H1 and multiple Windows Server editions allows an authorized local administrator to circumvent boot-time integrity protections by exploiting a non-updateable boot chain component. A successful attacker can subvert the UEFI Secure Boot trust chain to load unsigned or malicious code at the pre-OS stage, enabling persistent bootkit or rootkit implantation that survives OS reinstallation. No public exploit code has been identified and CISA SSVC reports no active exploitation, though the SSVC technical impact rating of 'total' correctly reflects full defeat of the boot integrity boundary.

Remote denial of service in the Windows TCP/IP stack lets an unauthorized adjacent-network attacker crash affected systems by triggering a NULL pointer dereference (CWE-476) via crafted network traffic. Reported by Microsoft and patched across the Windows 10, Windows 11, and Windows Server 2012-2025 families, the flaw requires no authentication or user interaction but is limited to attackers on the same logical network segment. EPSS is low (0.14%, 34th percentile) and CISA SSVC lists exploitation as none, so this is a real-but-not-urgent patch item with no public exploit identified at time of analysis.

Local privilege escalation in the Win32K GRFX (graphics) subsystem of Microsoft Windows allows an authenticated, low-privileged user to execute arbitrary code in the kernel context via a heap-based buffer overflow. All currently supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through 2025) are affected. There is no public exploit identified at time of analysis, and EPSS probability is very low (0.02%), but the total technical impact and low exploitation barrier make it a meaningful patch-priority for endpoint hardening.

Local denial of service in Microsoft Windows TCP/IP networking stack allows an unauthorized local attacker to trigger a null pointer dereference (CWE-476), crashing the system or causing broad service disruption. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025 are affected. Reported by Microsoft, this is a crash/availability issue only - no code execution or data exposure - with no public exploit identified at time of analysis and a very low (0.05%) EPSS exploitation probability.

Local privilege escalation in the Windows Remote Desktop component (CWE-122 heap-based buffer overflow) allows an authenticated low-privileged user to gain SYSTEM-level control across virtually all supported Windows client and server releases, from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. Microsoft has released patches; there is no public exploit identified at time of analysis and EPSS exploitation probability is very low (0.04%), consistent with CISA SSVC rating exploitation as 'none'. The flaw is a serious defense-in-depth concern because it grants total confidentiality, integrity, and availability impact once a foothold exists, but it is not remotely reachable and requires prior local access.

Windows Filtering Platform (WFP) on affected Windows 10, Windows 11, and Windows Server releases exposes an improper access control flaw (CWE-284) that enables a locally authenticated, low-privileged attacker to bypass a host-based security feature. The bypass is limited to confidentiality and integrity impacts (no availability), scoped to the vulnerable system, and requires no user interaction once local execution is established. No public exploit code exists and CISA has not added this to the KEV catalog; EPSS at 0.04% (11th percentile) and SSVC exploitation status of 'none' corroborate the low probability of near-term opportunistic weaponization.

Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user gain SYSTEM-level rights on affected Windows client and server builds by triggering an integer underflow (CWE-191) in the driver's log-file parsing. The flaw yields total confidentiality, integrity, and availability impact on the local machine. There is no public exploit identified at time of analysis, EPSS risk is low (0.06%, 19th percentile), and CISA SSVC records exploitation status as none - but CLFS is a historically heavily-targeted attack surface, so patching is warranted.

Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated (typically SYSTEM-level) privileges across nearly all supported Windows client and server releases. Microsoft has released patches, and the flaw carries a total technical-impact rating (SSVC), though EPSS is very low (0.04%) and there is no public exploit identified at time of analysis. It is not on CISA KEV, indicating no confirmed active exploitation.

Local privilege escalation in the Windows Link-Layer Discovery Protocol (LLDP) component affects a broad range of Windows client and server builds, where a CWE-415 double-free condition can be leveraged by an already-authenticated low-privileged user to gain higher privileges. The flaw was reported by Microsoft and is addressed in the July 2026 servicing updates; there is no public exploit identified at time of analysis and it is not listed in CISA KEV. EPSS is negligible (0.04%, 12th percentile), consistent with the high attack complexity (AC:H) and local-only vector.

Local privilege escalation in the Windows Projected File System (ProjFS) affects the full supported Windows line — Windows 10 (1809/21H2/22H2), Windows 11 (22H3 through 26H1), and Windows Server 2019/2022/2025 — where a use-after-free (CWE-416) lets an authenticated local user corrupt kernel/service memory and elevate to higher privileges. Microsoft-reported and patched, the flaw carries total technical impact per CISA SSVC but has no public exploit identified at time of analysis and a very low EPSS (0.04%). The high attack complexity (AV:L/AC:H) reflects a race-condition-style UAF that is non-trivial to win reliably.

Null pointer dereference in the Windows LDAP (Lightweight Directory Access Protocol) component enables a low-privileged local attacker to crash the LDAP service, causing a denial of service on all affected Windows 10, Windows 11, and Windows Server releases. The vulnerability carries a CVSS 3.1 score of 5.5 with a strictly local attack vector (AV:L/PR:L), confining impact to availability only - no data exfiltration or code execution is possible. With EPSS at 0.04% (11th percentile), SSVC exploitation status of 'none,' no KEV listing, and no public exploit identified, real-world exploitation risk is currently low despite the enormous Windows install base.

Local privilege escalation in the Windows Telephony Service (TAPI) affects a broad range of Windows client and server releases, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. An authenticated local attacker can exploit a use-after-free (CWE-416) memory-corruption flaw to gain SYSTEM-level privileges; there is no public exploit identified at time of analysis and EPSS is very low (0.04%), but the CVSS 3.1 base score is 7.8 with total technical impact per CISA SSVC.

Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across a broad range of Windows 10, Windows 11, and Windows Server builds. Microsoft has released fixes, but SSVC reports no observed exploitation and EPSS is very low (0.04%), so this is a patch-on-schedule kernel EoP rather than an emergency; no public exploit identified at time of analysis. Because Cloud Files underpins OneDrive/cloud sync placeholders, the driver is present on effectively every modern Windows install.

Local information disclosure in the Microsoft Windows Desktop Window Manager (DWM) Core Library affects a broad range of Windows 10, Windows 11 (through 26H1), and Windows Server (2016-2025) builds, where a buffer over-read (CWE-126) lets an already-authenticated local attacker read adjacent process memory. Microsoft's CVSS 7.8 vector rates full confidentiality, integrity, and availability impact even though the description characterizes the outcome as information disclosure, so the leaked memory could plausibly aid further local escalation. There is no public exploit identified at time of analysis, EPSS is negligible (0.04%), and CISA SSVC marks exploitation as none, but a vendor patch is available.

Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an already-authenticated attacker to win a race condition and elevate to SYSTEM-level privileges across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025). Exploitation requires local, low-privileged access rather than remote reach, and Microsoft rates the technical impact as total (full confidentiality, integrity, and availability loss). There is no public exploit identified at time of analysis and EPSS probability is very low (0.04%), consistent with CISA SSVC marking exploitation as none and not automatable.

Local privilege escalation in Microsoft Windows Message Queuing (MSMQ) allows an authenticated low-privileged user to corrupt kernel/service memory through a double free (CWE-415) and elevate to SYSTEM. It affects a broad range of Windows client and server releases from Windows Server 2012/Windows 10 1607 through Windows 11 26H1 and Windows Server 2025 where the MSMQ feature is installed. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC records no known exploitation, though the technical impact is rated total.

Local privilege escalation in the Microsoft Windows TCP/IP stack (tcpip.sys) lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across virtually all supported Windows client and server releases. Microsoft assigns CVSS 7.8 and reports total technical impact, but SSVC exploitation status is 'none' and EPSS is only 0.06% (18th percentile), and there is no public exploit identified at time of analysis. Microsoft has released a patch via the Security Update Guide.

Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) allows an authenticated low-privileged user to elevate to SYSTEM by triggering a use-after-free memory-corruption condition. The flaw was reported by Microsoft and affects a broad range of Windows 10, Windows 11, and Windows Server builds; a vendor patch is available. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.06%).

Local privilege escalation in the Microsoft Windows Telephony Service (TAPI) lets an already-authenticated, low-privileged user corrupt kernel/service memory via a use-after-free and gain elevated privileges across virtually all supported Windows client and server builds. Microsoft has released a patch, and there is no public exploit identified at time of analysis; EPSS is negligible (0.04%) and CISA's SSVC rates exploitation as none, indicating this is a defense-in-depth fix rather than an emergency. The flaw is high-value as a post-compromise escalation primitive but requires local code execution and winning a race condition to trigger.

Privilege escalation via double free in the Windows Rich Text Edit Control (RichEdit) affects an exceptionally broad range of Microsoft platforms, spanning Windows 10 versions 1607 through 22H2, all current Windows 11 branches through 26H1, and Windows Server 2012 through Server 2025. A low-privileged local attacker who can induce user interaction with crafted RTF content can corrupt heap memory to achieve full compromise of confidentiality, integrity, and availability - consistent with the SSVC 'total technical impact' rating. No public exploit code exists and no active exploitation has been identified (not in CISA KEV), and the EPSS score of 0.05% at the 16th percentile reflects a minimal current exploitation signal; however, the sheer scale of the affected Windows install base keeps this relevant for enterprise patch cadence. A notable discrepancy exists: the CVE tags classify this as 'Information Disclosure,' which conflicts with Microsoft's own description of local privilege elevation - the CVSS C:H/I:H/A:H impact metrics and SSVC total-impact rating support the privilege escalation characterization, suggesting the tag is erroneous.

Remote code execution in the Windows Native WiFi Miniport Driver allows an unauthorized attacker on an adjacent network to win a timing race and run arbitrary code on affected Windows 10, Windows 11, and Windows Server systems. The flaw stems from improper synchronization of a shared resource in the kernel-mode wireless driver and carries a total (C:H/I:H/A:H) technical impact. No public exploit has been identified and EPSS is very low (0.07%), but successful exploitation grants full kernel-level compromise without authentication.

Remote code execution in Microsoft Windows DNS lets an unauthenticated attacker corrupt heap memory over the network and run arbitrary code on affected Windows 11 (22H3 through 26H1) and Windows Server 2022/2025 systems. The flaw is a CWE-122 heap-based buffer overflow rated CVSS 9.8, reported by Microsoft with a patch available; there is no public exploit identified at time of analysis, and the EPSS score is very low (0.07%), so this is a high-severity but not-yet-exploited issue. CISA SSVC flags it as automatable with total technical impact, meaning successful exploitation fully compromises the host.

Local privilege escalation in the Windows Server Data Deduplication feature (dedup.sys / associated services) lets an authenticated low-privileged user corrupt kernel memory to gain SYSTEM-level rights. Reported by Microsoft across Windows Server 2012 R2 through 2025, it carries a CVSS 7.8 and total technical impact per CISA SSVC, but has no public exploit identified at time of analysis and a very low EPSS of 0.04% (13th percentile). It is not listed in CISA KEV and shows no evidence of active exploitation.

Remote code execution in the Windows Netlogon service (across Windows Server 2012 through 2025) allows an unauthenticated attacker to run arbitrary code over the network by triggering a stack-based buffer overflow (CWE-121). With a CVSS 3.1 vector of AV:N/AC:L/PR:N/UI:N and total technical impact, this is a critical, pre-authentication server-side flaw. Microsoft has released patches; publicly available exploit code exists, though EPSS remains low (0.09%) and there is no confirmed active exploitation at time of analysis.

Local privilege escalation in the Windows Ancillary Function Driver for WinSock (afd.sys) allows an already-authenticated low-privileged user to elevate to SYSTEM across Windows 10, Windows 11 (21H2 through 26H1), and Windows Server 2022/2025. The flaw stems from external control of a file name or path (CWE-73) inside the kernel-mode WinSock support driver, yielding total confidentiality, integrity, and availability impact per CVSS 7.8. There is no public exploit identified at time of analysis, EPSS is very low (0.07%), and CISA SSVC records exploitation as none, but the total technical impact and near-universal Windows footprint make it a standard Patch Tuesday priority.

Remote code execution in the Microsoft Windows TCP/IP stack allows an unauthenticated network attacker to trigger a use-after-free (CWE-416) and run arbitrary code on a wide range of Windows 10, Windows 11, and Windows Server builds. The flaw carries CVSS 8.1 but requires winning a memory-corruption race (AC:H), and there is no public exploit identified at time of analysis; EPSS is very low at 0.09% and CISA SSVC lists exploitation as none. A vendor patch is available from Microsoft.

Denial of service in the Microsoft Windows TCP/IP networking stack allows an unauthenticated, adjacent-network attacker to crash the host by triggering a null pointer dereference (CWE-476) during packet processing, with no user interaction required. The flaw affects essentially the entire supported Windows client and server lineup, from Windows 10 1607 and Server 2012 through Windows 11 26H1 and Server 2025. There is no public exploit identified at time of analysis, and the low EPSS score (0.14%) plus CISA SSVC 'Exploitation: none' indicate no observed exploitation despite the broad footprint.

Local privilege escalation in the Microsoft Windows SMB Client (mrxsmb/rdbss) driver lets a low-privileged, authenticated user corrupt kernel memory through a use-after-free (CWE-416) and elevate to SYSTEM. The flaw affects a broad range of Windows client and server builds from Windows Server 2012 R2 through Windows 11 25H2/26H1 and Server 2025. There is no public exploit identified at time of analysis, EPSS is very low (0.04%), and CISA SSVC rates exploitation as 'none' - but technical impact is 'total', so it remains a meaningful patch-Tuesday-class local EoP.

Local privilege escalation in Microsoft Windows Kernel-Mode Drivers allows an already-authenticated attacker to elevate to SYSTEM by triggering a use-after-free (CWE-416) memory-corruption condition. All supported Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Windows Server 2025 are affected, but there is no public exploit identified at time of analysis and EPSS probability is very low (0.04%). Microsoft has released patches and CISA's SSVC framework rates exploitation as 'none' with total technical impact.

Local privilege escalation in the Windows Common Log File System (CLFS) driver lets an already-authenticated low-privileged user corrupt heap memory to gain SYSTEM-level control across a broad range of Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Server 2012 through Server 2025). Exploitation is CVSS 7.8 with total technical impact per CISA SSVC, but SSVC records no observed exploitation and EPSS is very low (0.04%), and no public exploit was identified at time of analysis. A vendor patch is available from Microsoft (MSRC).

Information disclosure in the Windows TCP/IP networking stack allows a remote, unauthenticated attacker to read sensitive memory contents over the network by triggering a use-after-free condition. All supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, and Windows Server 2012 through 2025) are affected. Microsoft-reported with no public exploit identified at time of analysis; EPSS is low (0.06%, 19th percentile) and CISA SSVC records exploitation status as none.

Local privilege escalation in the Microsoft Windows TCP/IP networking stack allows an authorized (low-privileged) attacker to run code with SYSTEM-level rights by triggering a stack-based buffer overflow (CWE-121). The flaw affects a broad range of Windows 10, Windows 11, and Windows Server releases and carries a CVSS 7.8 with total technical impact per CISA SSVC. There is no public exploit identified at time of analysis, EPSS is very low (0.06%, 19th percentile), and it is not listed in CISA KEV, indicating no observed exploitation to date.

Heap-based buffer overflow in the Windows Volume Manager Extension Driver enables an authorized attacker with physical device access to execute arbitrary code, achieving full system compromise across a broad range of Windows 10, Windows 11, and Windows Server editions. Affected product versions span from Windows Server 2012 through Windows 11 26H1 and Windows Server 2025, per EUVD-2026-29656 data. No active exploitation has been confirmed (not in CISA KEV), and EPSS at 0.07% (22nd percentile) reflects the extremely low probability of widespread exploitation given the dual prerequisite of physical presence and high-privilege credentials.

Local privilege escalation in Windows Cryptographic Services lets an authenticated low-privileged user corrupt heap memory (CWE-122) to gain SYSTEM-level control across supported Windows 10, Windows 11, and Windows Server builds. There is no public exploit identified at time of analysis and EPSS is very low (0.04%), but SSVC rates the technical impact as total, and Microsoft has released patches. Because it requires prior local access, it is a post-compromise escalation primitive rather than an initial-access threat.

Denial of service in the Windows Internet Key Exchange (IKE) protocol implementation allows remote unauthenticated attackers to exhaust host memory across all supported Windows client and server releases (Windows 10 1607 through Windows 11 26H1, Windows Server 2012 through Server 2025). The flaw is a memory leak (CWE-401) triggered over the network with no privileges or user interaction, but impact is limited to availability with no data exposure. There is no public exploit identified at time of analysis, and EPSS exploitation probability is very low (0.08%, 23rd percentile).

Out-of-bounds read in the Windows Telnet Client exposes memory contents and minor availability degradation to network-based attackers who control a Telnet server endpoint. Affected systems span Windows 10 (1607 through 22H2), Windows 11 (22H3 through 26H1), and Windows Server 2012 through 2025, all requiring user interaction to initiate a Telnet session against a malicious server. No public exploit identified at time of analysis and no active exploitation confirmed (not in CISA KEV); EPSS stands at 0.05% (16th percentile), reinforcing that real-world exploitation risk is low despite the broad platform footprint.

Windows TCP/IP stack allows a low-privilege network-authenticated attacker to bypass a security feature by exploiting an alternate path or channel (CWE-288), resulting in a high-integrity impact without requiring user interaction. Affected scope spans Windows 10 (versions 1607 through 22H2), Windows 11 (versions 22H3 through 26H1), and Windows Server 2012 through Server 2025, making the exposure footprint extremely broad. No public exploit code exists and no active exploitation is confirmed at time of analysis; EPSS at 0.06% (18th percentile) and SSVC classification of 'exploitation: none, automatable: no' indicate low near-term weaponization risk despite the wide attack surface.

Local code execution in the Windows Graphics Device Interface (GDI) component affects a broad range of Windows client and server releases from Windows Server 2012 through Windows 11 25H2/26H1 and Server 2025. An attacker who convinces a user to open a maliciously crafted file or content triggers a heap-based buffer overflow (CWE-122) in GDI, running arbitrary code in the victim's context with full confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis, EPSS is very low (0.06%), and CISA SSVC records no known exploitation, so this is a patch-on-cycle item rather than an emergency.

Local privilege escalation in the Windows Kernel affects a broad range of Windows Server releases (2012 through 2025, including Server Core installations), where a heap-based buffer overflow (CWE-122) lets an already-authenticated local user corrupt kernel heap memory to gain SYSTEM-level privileges. Microsoft has released patches and rates it CVSS 7.8; there is no public exploit identified at time of analysis, and CISA's SSVC framework marks exploitation as none but technical impact as total. EPSS is very low (0.04%, 13th percentile), consistent with the local-only attack vector that requires prior code execution on the host.

Local privilege escalation in the Windows Cloud Files Mini Filter Driver (cldflt.sys) lets an already-authenticated low-privileged user corrupt kernel memory via a use-after-free and gain SYSTEM-level control across supported Windows 10, Windows 11 (through 26H1) and Windows Server 2019-2025 builds. Microsoft has released fixes; there is no public exploit identified at time of analysis, EPSS risk is very low (0.04%), and it is not listed in CISA KEV. Despite 'Denial Of Service' tagging, the CVSS vector rates full confidentiality, integrity and availability impact, consistent with a kernel EoP.

Local privilege escalation in the Windows Win32K kernel-mode subsystem (ICOMP component) lets an already-authenticated low-privileged attacker gain SYSTEM-level control across a broad range of supported Windows client and server builds. The flaw is a type-confusion (CWE-843) memory-corruption issue reported by Microsoft; there is no public exploit identified at time of analysis and the EPSS probability is low (0.11%), but SSVC rates the technical impact as total. This is a standard Patch-Tuesday-class kernel EoP whose value is as the second stage of an intrusion after an attacker already has a foothold.

Local privilege escalation in Windows Kernel across Windows 10, Windows 11 (versions 22H3 through 26H1), and Windows Server 2022 allows authenticated local attackers to gain SYSTEM-level privileges through heap corruption. Microsoft has released patches addressing this CWE-122 heap-based buffer overflow. EPSS data not available for risk quantification, and no CISA KEV listing indicates exploitation has not been publicly confirmed, though the vulnerability's low attack complexity (AC:L) and minimal prerequisites (PR:L) make it attractive for post-compromise privilege escalation in targeted attacks.

Windows Snipping Tool leaks sensitive information to unauthenticated network attackers via user interaction, enabling spoofing attacks. The vulnerability affects Windows 10 (versions 1607, 1809, 21H2, 22H2) and Windows 11 (versions 22H3, 23H2, 24H2, 25H2, 26H1), as well as Windows Server 2012 through 2025. Microsoft has released patches for all affected versions; exploitation requires user interaction but no specialized technical knowledge.

Remote code execution in Windows IKE Extension (Internet Key Exchange) via double free memory corruption allows unauthenticated network attackers to execute arbitrary code on Windows 10 (1607-22H2), Windows 11 (22H3-26H1), and Windows Server (2016-2025). CVSS 9.8 critical severity with network vector requiring no authentication or user interaction. Vendor patch released by Microsoft addresses CWE-415 double free weakness. EPSS score of 0.07% (21st percentile) suggests low observed exploitation probability despite critical severity rating, indicating this may be a targeted or difficult-to-exploit vulnerability in production environments. No CISA KEV listing or public POC identified at time of analysis.

Remote code execution in Windows TCP/IP networking stack across Windows 10, 11, and Server versions allows unauthenticated network attackers to execute arbitrary code by exploiting a race condition in shared resource synchronization. The vulnerability affects all supported Windows versions from Server 2012 through Windows 11 26H1 and Server 2025. Microsoft has released patches addressing this high-severity flaw (CVSS 8.1). No public exploit identified at time of analysis, though SSVC assessment

Local privilege escalation in Windows Win32K graphics subsystem (Win32K-GRFX) allows authenticated attackers with low privileges to gain SYSTEM-level access by exploiting a race condition during concurrent resource access. Affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. Microsoft has released patches addressing this CWE-362 synchronization flaw. No public exploit identified at time of analysis, though the local attack vector and high complexity (

Local privilege escalation in Windows Print Spooler Components allows authenticated attackers with low privileges to achieve complete system compromise (high confidentiality, integrity, and availability impact) by exploiting a use-after-free memory corruption vulnerability. Affects Windows 11 versions 24H2, 25H2, 26H1, Windows Server 2022 23H2 Edition, and Windows Server 2025. CVSS score 7.8 reflects local attack vector with low complexity and no user interaction required. No public exploit or CISA KEV status identified at time of analysis, though use-after-free vulnerabilities in Print Spooler have historically been attractive exploitation targets.

Local privilege escalation in Windows Ancillary Function Driver for WinSock (AFD.sys) affects all supported Windows 10, Windows 11, and Windows Server versions from 2012 through 2025. The CWE-416 use-after-free memory corruption flaw allows low-privileged authenticated attackers with local access to elevate to SYSTEM privileges, achieving complete control over confidentiality, integrity, and availability. SSVC framework rates this as non-automatable with total technical impact. No public exploit

Local privilege escalation via use-after-free in Windows Ancillary Function Driver for WinSock (AFD.sys) allows authenticated low-privileged attackers to execute arbitrary code with SYSTEM privileges across all supported Windows versions. Microsoft has released patches for Windows 10 (versions 1607-22H2), Windows 11 (versions 22H3-25H2), and Windows Server (2012-2022 23H2). The vulnerability requires local access and low privileges (PR:L) with high attack complexity (AC:H), but no public exploit

Windows Shell security feature bypass enables unauthenticated remote attackers to defeat protection mechanisms across all supported Windows client and server versions (Windows 10 1607 through Windows 11 26H1, Server 2012 through Server 2025) via network-based attack requiring user interaction. The CVSS 8.8 rating reflects complete compromise potential (high confidentiality, integrity, and availability impact) despite low attack complexity. Microsoft has released patches addressing this authentic

Remote code execution in Windows Active Directory Domain Services affects all supported Windows Server versions (2012 R2 through 2025) when an authenticated attacker with low privileges on an adjacent network sends specially crafted requests to domain controllers. The vulnerability stems from improper input validation (CWE-20) and enables complete system compromise with high impact to confidentiality, integrity, and availability. Patch available per vendor advisory; no public exploit identified at time of analysis. CVSS 8.0 severity reflects adjacent network attack vector requiring low-privilege authentication but trivial attack complexity with no user interaction.

Local privilege escalation in Windows Container Isolation FS Filter Driver affects all supported Windows 10, Windows 11, and Windows Server versions through use-after-free memory corruption. Low-complexity attack requires only low-privileged local access to achieve full system compromise (SYSTEM-level privileges). Microsoft has released patches for all affected versions. No public exploit identified at time of analysis, but the low attack complexity (AC:L) and requirement for only low privileges

Denial of service in Windows HTTP.sys kernel-mode driver allows unauthenticated remote attackers to crash affected systems via malformed HTTP requests. Affects all currently supported Windows 11 versions (22H2 through 26H1) and Windows Server 2022/2025 editions. The vulnerability stems from an out-of-bounds read (CWE-125) triggered when HTTP.sys processes specially crafted network packets without authentication (CVSS AV:N/PR:N). Vendor-released patches available for all affected versions with specific build numbers identified. No public exploit identified at time of analysis, though low attack complexity (AC:L) suggests straightforward exploitation once technical details emerge.

Windows Shell protection mechanism failure (CVE-2026-32202) allows remote attackers to perform spoofing attacks over a network without authentication, requiring only user interaction. This low-severity vulnerability affects multiple Windows versions from Windows 10 1607 through Windows 11 26H1 and Windows Server 2012 through 2025. While not actively exploited in the wild, vendor patches are available across all affected versions, and the low CVSS score (4.3) reflects limited confidentiality impact and no availability impact despite the network-accessible attack vector.