Windows Server 2016
by Microsoft
CVEs (5,109)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2020-16910 | Med | 0.41 | 6.2 | 0.03 | Oct 16, 2020 | A security feature bypass vulnerability exists when Microsoft Windows fails to handle file creation permissions, which could allow an attacker to create files in a protected Unified Extensible Firmware Interface (UEFI) location. To exploit this vulnerability, an… | ||
| CVE-2019-0975 | Med | 0.41 | 6.3 | 0.02 | Jul 15, 2019 | A security feature bypass vulnerability exists when Active Directory Federation Services (ADFS) improperly updates its list of banned IP addresses. To exploit this vulnerability, an attacker would have to convince a victim ADFS administrator to update the list of banned IP… | ||
| CVE-2019-1053 | Med | 0.41 | 6.3 | 0.01 | Jun 12, 2019 | An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerability could elevate privileges by escaping a sandbox. To exploit this vulnerability, an attacker would require… | ||
| CVE-2019-0986 | Med | 0.41 | 6.3 | 0.02 | Jun 12, 2019 | An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker… | ||
| CVE-2017-0055 | Med | 0.41 | 6.1 | 0.16 | Mar 17, 2017 | Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site… | ||
| CVE-2026-40380 | Med | 0.40 | 6.2 | 0.00 | May 12, 2026 | Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack. | ||
| CVE-2026-32072 | Med | 0.40 | 6.2 | 0.00 | Apr 14, 2026 | Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally. | ||
| CVE-2026-26169 | Med | 0.40 | 6.1 | 0.02 | Apr 14, 2026 | Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally. | ||
| CVE-2026-25169 | Med | 0.40 | 6.2 | 0.00 | Mar 10, 2026 | Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally. | ||
| CVE-2026-25168 | Med | 0.40 | 6.2 | 0.00 | Mar 10, 2026 | Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally. | ||
| CVE-2026-20821 | Med | 0.40 | 6.2 | 0.01 | Jan 13, 2026 | Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally. | ||
| CVE-2026-20818 | Med | 0.40 | 6.2 | 0.01 | Jan 13, 2026 | Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally. | ||
| CVE-2025-59258 | Med | 0.40 | 6.2 | 0.01 | Oct 14, 2025 | Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally. | ||
| CVE-2025-55338 | Med | 0.40 | 6.1 | 0.03 | Oct 14, 2025 | Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | ||
| CVE-2025-55333 | Med | 0.40 | 6.1 | 0.01 | Oct 14, 2025 | Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack. | ||
| CVE-2025-47980 | Med | 0.40 | 6.2 | 0.01 | Jul 8, 2025 | Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally. | ||
| CVE-2025-30394 | Med | 0.40 | 5.9 | 0.30 | May 13, 2025 | Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network. | ||
| CVE-2025-29957 | Med | 0.40 | 6.2 | 0.01 | May 13, 2025 | Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally. | ||
| CVE-2025-21278 | Med | 0.40 | 6.2 | 0.01 | Jan 14, 2025 | Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability | ||
| CVE-2025-21202 | Med | 0.40 | 6.1 | 0.01 | Jan 14, 2025 | Windows Recovery Environment Agent Elevation of Privilege Vulnerability |
- risk 0.41cvss 6.2epss 0.03
A security feature bypass vulnerability exists when Microsoft Windows fails to handle file creation permissions, which could allow an attacker to create files in a protected Unified Extensible Firmware Interface (UEFI) location. To exploit this vulnerability, an…
- risk 0.41cvss 6.3epss 0.02
A security feature bypass vulnerability exists when Active Directory Federation Services (ADFS) improperly updates its list of banned IP addresses. To exploit this vulnerability, an attacker would have to convince a victim ADFS administrator to update the list of banned IP…
- risk 0.41cvss 6.3epss 0.01
An elevation of privilege vulnerability exists when the Windows Shell fails to validate folder shortcuts. An attacker who successfully exploited the vulnerability could elevate privileges by escaping a sandbox. To exploit this vulnerability, an attacker would require…
- risk 0.41cvss 6.3epss 0.02
An elevation of privilege vulnerability exists when the Windows User Profile Service (ProfSvc) improperly handles symlinks. An attacker who successfully exploited this vulnerability could delete files and folders in an elevated context. To exploit this vulnerability, an attacker…
- risk 0.41cvss 6.1epss 0.16
Microsoft Internet Information Server (IIS) in Windows Vista SP2; Windows Server 2008 SP2 and R2; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; Windows 10 Gold, 1511, and 1607; and Windows Server 2016 allows remote attackers to perform cross-site…
- risk 0.40cvss 6.2epss 0.00
Heap-based buffer overflow in Volume Manager Extension Driver allows an authorized attacker to execute code with a physical attack.
- risk 0.40cvss 6.2epss 0.00
Improper authentication in Windows Active Directory allows an unauthorized attacker to perform spoofing locally.
- risk 0.40cvss 6.1epss 0.02
Buffer over-read in Windows Kernel Memory allows an authorized attacker to disclose information locally.
- risk 0.40cvss 6.2epss 0.00
Divide by zero in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.
- risk 0.40cvss 6.2epss 0.00
Null pointer dereference in Microsoft Graphics Component allows an unauthorized attacker to deny service locally.
- risk 0.40cvss 6.2epss 0.01
Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.2epss 0.01
Insertion of sensitive information into log file in Windows Kernel allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.2epss 0.01
Insertion of sensitive information into log file in Active Directory Federation Services allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 6.1epss 0.03
Missing Ability to Patch ROM Code in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- risk 0.40cvss 6.1epss 0.01
Incomplete comparison with missing factors in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
- risk 0.40cvss 6.2epss 0.01
Exposure of sensitive information to an unauthorized actor in Windows Imaging Component allows an unauthorized attacker to disclose information locally.
- risk 0.40cvss 5.9epss 0.30
Sensitive data storage in improperly locked memory in Remote Desktop Gateway Service allows an unauthorized attacker to deny service over a network.
- risk 0.40cvss 6.2epss 0.01
Uncontrolled resource consumption in Windows Deployment Services allows an unauthorized attacker to deny service locally.
- risk 0.40cvss 6.2epss 0.01
Windows Remote Desktop Gateway (RD Gateway) Denial of Service Vulnerability
- risk 0.40cvss 6.1epss 0.01
Windows Recovery Environment Agent Elevation of Privilege Vulnerability
Page 197 of 256