Windows Server 2016 (Microsoft) - vulnerabilities (CVEs)

6417 CVEs, 759 in the last 30 days, 102 known versions, newest CVE from 2026-10-13. Vendor: Microsoft.

CVEs of Windows Server 2016

• CVE-2026-108136 - CVSS 7.8 (high), 2026-10-13: Use after free in Microsoft Windows Search Component allows an authorized attacker to elevate privileges locally.
• CVE-2026-108129 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-108131 - CVSS 7.5 (high), 2026-10-13: No cwe for this issue in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-108132 - CVSS 7 (high), 2026-10-13: Double free in Windows Kerberos allows an authorized attacker to elevate privileges locally.
• CVE-2026-108127 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-108128 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97839 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97840 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97841 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97842 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97843 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97844 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97827 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97828 - CVSS 6.5 (medium), 2026-10-13: Buffer over-read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97829 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97831 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97832 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97833 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97834 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97835 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97836 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97837 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97838 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97814 - CVSS 9.8 (critical), 2026-10-13: Heap-based buffer overflow in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
• CVE-2026-97815 - CVSS 9.8 (critical), 2026-10-13: Heap-based buffer overflow in Windows Error Reporting allows an unauthorized attacker to execute code over a network.
• CVE-2026-97817 - CVSS 6.5 (medium), 2026-10-13: Heap-based buffer overflow in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97819 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97820 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97821 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97822 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97823 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97824 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97825 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97826 - CVSS 6.5 (medium), 2026-10-13: Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-96113 - CVSS 9.8 (critical), 2026-10-13: Heap-based buffer overflow in DNS Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-97804 - CVSS 7.8 (high), 2026-10-13: Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
• CVE-2026-97805 - CVSS 9.8 (critical), 2026-10-13: Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.
• CVE-2026-105007 - CVSS 8.8 (high), 2026-10-13: An elevation of privilege vulnerability exists in the Network Driver Interface Specification (NDIS) when ndis.sys fails to check the length of a buffer prior…
• CVE-2026-105008 - CVSS 9 (critical), 2026-10-13: No cwe for this issue in Windows Schannel allows an unauthorized attacker to perform spoofing over a network.
• CVE-2026-105009 - CVSS 7.5 (high), 2026-10-13: Incorrect default permissions in Windows Server Update Service allows an authorized attacker to elevate privileges locally.
• CVE-2026-105010 - CVSS 9.8 (critical), 2026-10-13: Use after free in Microsoft Windows Search Component allows an unauthorized attacker to elevate privileges over a network.
• CVE-2026-103568 - CVSS 7.8 (high), 2026-10-13: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Credential Providers allows an authorized attacker to…
• CVE-2026-103569 - CVSS 7.5 (high), 2026-10-13: Out-of-bounds read in Windows IKE Extension allows an unauthorized attacker to disclose information over a network.
• CVE-2026-103575 - CVSS 8.8 (high), 2026-10-13: Use after free in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
• CVE-2026-103576 - CVSS 6.5 (medium), 2026-10-13: Url redirection to untrusted site ('open redirect') in Active Directory Federation Services (AD FS) allows an unauthorized attacker to perform spoofing over a…
• CVE-2026-105003 - CVSS 7.8 (high), 2026-10-13: Heap-based buffer overflow in HID class driver allows an authorized attacker to elevate privileges locally.
• CVE-2026-105004 - CVSS 7.8 (high), 2026-10-13: Out-of-bounds read in Windows Overlay Filter allows an authorized attacker to elevate privileges locally.
• CVE-2026-105006 - CVSS 6.4 (medium), 2026-10-13: Use after free in HID class driver allows an unauthorized attacker to elevate privileges with a physical attack.
• CVE-2026-100215 - CVSS 7.8 (high), 2026-10-13: Heap-based buffer overflow in Microsoft Graphics Component allows an unauthorized attacker to execute code locally.
• CVE-2026-102217 - CVSS 8.8 (high), 2026-10-13: Improper resolution of path equivalence in WebDAV allows an authorized attacker to elevate privileges over a network.
• CVE-2026-102225 - CVSS 8.8 (high), 2026-10-13: Out-of-bounds read in Windows Text Shaping allows an unauthorized attacker to execute code over a network.
• CVE-2026-103553 - CVSS 7.8 (high), 2026-10-13: Out-of-bounds read in Windows Partition Management Driver allows an authorized attacker to elevate privileges locally.
• CVE-2026-103555 - CVSS 7 (high), 2026-10-13: Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
• CVE-2026-103558 - CVSS 7.5 (high), 2026-10-13: Deadlock in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to deny service over a network.
• CVE-2026-103560 - CVSS 5.5 (medium), 2026-10-13: Improper authorization in DNS Server allows an authorized attacker to perform tampering locally.
• CVE-2026-109453 - CVSS 7 (high), 2026-10-13: Heap-based buffer overflow in Virtual Hard Disk (VHD) Miniport Driver allows an authorized attacker to elevate privileges locally.
• CVE-2026-102205 - CVSS 7.8 (high), 2026-10-13: Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
• CVE-2026-102207 - CVSS 7 (high), 2026-10-13: Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate…
• CVE-2026-102208 - CVSS 7 (high), 2026-10-13: Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally.
• CVE-2026-102211 - CVSS 7 (high), 2026-10-13: Use after free in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to elevate privileges locally.
• CVE-2026-102214 - CVSS 8.8 (high), 2026-10-13: Use after free in Windows Hyper-V allows an authorized attacker to execute code locally.
• CVE-2026-102215 - CVSS 7.8 (high), 2026-10-13: Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
• CVE-2026-102216 - CVSS 7.8 (high), 2026-10-13: Access of resource using incompatible type ('type confusion') in Windows StateRepository API allows an authorized attacker to elevate privileges locally.
• CVE-2026-102218 - CVSS 7.8 (high), 2026-10-13: Heap-based buffer overflow in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
• CVE-2026-102220 - CVSS 7.8 (high), 2026-10-13: Use after free in Windows VHD miniport driver allows an authorized attacker to elevate privileges locally.
• CVE-2026-102221 - CVSS 4.4 (medium), 2026-10-13: No cwe for this issue in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
• CVE-2026-102194 - CVSS 7 (high), 2026-10-13: Use after free in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
• CVE-2026-102198 - CVSS 5.3 (medium), 2026-10-13: Out-of-bounds read in Windows Remote Desktop Protocol allows an authorized attacker to disclose information over a network.
• CVE-2026-102199 - CVSS 6.5 (medium), 2026-10-13: Stack-based buffer overflow in Microsoft Windows Codecs Library allows an unauthorized attacker to deny service over a network.
• CVE-2026-102203 - CVSS 8.8 (high), 2026-10-13: Access of resource using incompatible type ('type confusion') in RPC Runtime allows an unauthorized attacker to execute code over a network.
• CVE-2026-102206 - CVSS 6.8 (medium), 2026-10-13: Heap-based buffer overflow in Windows Portable Device MTP Driver allows an unauthorized attacker to elevate privileges with a physical attack.
• CVE-2026-102186 - CVSS 4.7 (medium), 2026-10-13: Untrusted pointer dereference in Windows Network File System allows an authorized attacker to disclose information locally.
• CVE-2026-102187 - CVSS 5.5 (medium), 2026-10-13: Use of uninitialized resource in Windows Kernel allows an authorized attacker to disclose information locally.
• CVE-2026-102188 - CVSS 6.8 (medium), 2026-10-13: Untrusted pointer dereference in Windows Storage Port Driver allows an unauthorized attacker to elevate privileges with a physical attack.
• CVE-2026-70212 - CVSS 7 (high), 2026-10-13: Improper restriction of communication channel to intended endpoints in Windows Security Center allows an authorized attacker to elevate privileges locally.
• CVE-2026-88226 - CVSS 4.6 (medium), 2026-10-13: Out-of-bounds read in Windows Storage Port Driver allows an unauthorized attacker to disclose information with a physical attack.
• CVE-2026-96209 - CVSS 7 (high), 2026-10-13: Out-of-bounds read in Windows Network File System allows an authorized attacker to elevate privileges locally.
• CVE-2026-100217 - CVSS 7.8 (high), 2026-10-13: Improper privilege management in Windows Group Policy allows an authorized attacker to elevate privileges locally.
• CVE-2026-100218 - CVSS 8.1 (high), 2026-10-13: Use after free in Remote Desktop Gateway Service allows an unauthorized attacker to execute code over a network.
• CVE-2026-100220 - CVSS 8.8 (high), 2026-10-13: Heap-based buffer overflow in Windows Media Video Decoder allows an unauthorized attacker to execute code over a network.
• CVE-2026-100222 - CVSS 9.8 (critical), 2026-10-13: Heap-based buffer overflow in Network Policy Server (NPS) allows an unauthorized attacker to execute code over a network.
• CVE-2026-100225 - CVSS 7 (high), 2026-10-13: Heap-based buffer overflow in Windows Storage allows an authorized attacker to elevate privileges locally.
• CVE-2026-69506 - CVSS 4.7 (medium), 2026-10-13: Out-of-bounds read in Windows Key Storage Provider allows an authorized attacker to disclose information locally.
• CVE-2026-88219 - CVSS 8.8 (high), 2026-10-13: Untrusted pointer dereference in RPC Runtime allows an unauthorized attacker to execute code over a network.
• CVE-2026-100202 - CVSS 9.8 (critical), 2026-10-13: Use after free in Windows Message Queuing Queue Manager allows an unauthorized attacker to execute code over a network.
• CVE-2026-100203 - CVSS 7 (high), 2026-10-13: Heap-based buffer overflow in Windows Update Service allows an authorized attacker to elevate privileges locally.
• CVE-2026-96071 - CVSS 7.5 (high), 2026-10-13: Heap-based buffer overflow in Windows Media allows an unauthorized attacker to execute code over a network.
• CVE-2026-96118 - CVSS 7.8 (high), 2026-10-13: Out-of-bounds read in Windows Graphics Kernel allows an authorized attacker to elevate privileges locally.
• CVE-2026-97788 - CVSS 7.5 (high), 2026-10-13: Observable discrepancy in Active Directory Federation Services (AD FS) allows an unauthorized attacker to disclose information over a network.
• CVE-2026-96946 - CVSS 7.8 (high), 2026-10-13: Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
• CVE-2026-96947 - CVSS 7.8 (high), 2026-10-13: Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
• CVE-2026-96948 - CVSS 5.5 (medium), 2026-10-13: Exposure of sensitive information to an unauthorized actor in Windows Client Side Caching driver (csc.sys) allows an authorized attacker to disclose…
• CVE-2026-96949 - CVSS 7 (high), 2026-10-13: Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
• CVE-2026-96950 - CVSS 7.8 (high), 2026-10-13: Use after free in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to elevate privileges locally.
• CVE-2026-96951 - CVSS 8.8 (high), 2026-10-13: Improper neutralization of special elements used in a command ('command injection') in Windows Shell allows an unauthorized attacker to bypass a security…
• CVE-2026-96953 - CVSS 7.8 (high), 2026-10-13: Null pointer dereference in Windows Universal Disk Format File System Driver (UDFS) allows an authorized attacker to execute code locally.
• CVE-2026-69675 - CVSS 5.5 (medium), 2026-10-13: Out-of-bounds read in Windows Network File System allows an authorized attacker to disclose information locally.
• CVE-2026-96926 - CVSS 5.5 (medium), 2026-10-13: Missing authorization in DNS Server allows an authorized attacker to perform tampering locally.
• CVE-2026-96929 - CVSS 7.8 (high), 2026-10-13: Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
• CVE-2026-96931 - CVSS 7.8 (high), 2026-10-13: Untrusted pointer dereference in Windows NTFS allows an authorized attacker to elevate privileges locally.