windows_server_2022 vulnerabilities
CVEs whose affected-version data names the windows_server_2022 package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
2503 CVEsRSS
CVE-2026-41087Medium· 5.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
CVE-2026-40422Medium· 5.5Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.
Use of uninitialized resource in Windows File Explorer allows an authorized attacker to disclose information locally.
CVE-2026-40400High· 8.0Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.
Relative path traversal in Windows PowerShell allows an authorized attacker to execute code over a network.
CVE-2026-40378High· 7.5Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
Memory allocation with excessive size value in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
CVE-2026-34349Medium· 5.5Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.
Exposure of sensitive information to an unauthorized actor in Windows Media allows an authorized attacker to disclose information locally.
CVE-2026-34348Medium· 6.5PoCProtection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
Protection mechanism failure in Windows Event Logging Service allows an authorized attacker to disclose information over a network.
CVE-2026-34346Medium· 5.5Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.
Cleartext transmission of sensitive information in Windows Ancillary Function Driver for WinSock allows an authorized attacker to disclose information locally.
CVE-2026-34328Medium· 5.5Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally.
Exposure of sensitive information to an unauthorized actor in Windows Audio Service allows an authorized attacker to disclose information locally.
CVE-2026-33842Medium· 5.5Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.
CVE-2026-41108High· 7.0Windows DNS Client Elevation of Privilege Vulnerability
Heap-based buffer overflow in Microsoft Windows DNS allows an authorized attacker to elevate privileges locally.
CVE-2026-34335High· 7.0Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Use after free in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
CVE-2026-40409High· 7.8Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
CVE-2026-40404High· 7.8Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
Windows Universal Disk Format File System Driver (UDFS) Elevation of Privilege Vulnerability
CVE-2026-33828High· 7.8Windows Device Health Attestation (DHA) Elevation of Privilege Vulnerability
Trust boundary violation in Windows Attestation allows an authorized attacker to elevate privileges locally.
CVE-2026-45487High· 7.8Windows Program Compatibility Assistant Service Elevation of Privilege Vulnerability
Time-of-check time-of-use (TOCTOU) race condition in Program Compatibility Assistant Service allows an authorized attacker to elevate privileges locally.
CVE-2026-45605High· 7.8Windows Bluetooth Service Elevation of Privilege Vulnerability
Use after free in Windows Bluetooth Service allows an authorized attacker to elevate privileges locally.
CVE-2026-45640High· 7.0Windows Bluetooth Port Driver Elevation of Privilege Vulnerability
Use after free in Windows Bluetooth Port Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-45607High· 8.4Windows Hyper-V Remote Code Execution Vulnerability
Out-of-bounds read in Windows Hyper-V allows an unauthorized attacker to execute code locally.
CVE-2026-45606Medium· 5.5Microsoft UxTheme Library (uxtheme.dll) Denial of Service Vulnerability
Out-of-bounds read in Microsoft UxTheme Library (uxtheme.dll) allows an authorized attacker to deny service locally.
CVE-2026-45641High· 8.4Windows Hyper-V Remote Code Execution Vulnerability
Access of resource using incompatible type ('type confusion') in Windows Hyper-V allows an unauthorized attacker to execute code locally.
CVE-2026-45634Medium· 5.5Windows DHCP Client Information Disclosure Vulnerability
Out-of-bounds read in Windows DHCP Server allows an authorized attacker to disclose information locally.
CVE-2026-45642Low· 3.9Microsoft Azure Attestation service and Device Health Attestation Service Spoofing Vulnerability
Improper input validation in Microsoft Azure Attestation service and Device Health Attestation Service allows an authorized attacker to perform spoofing with a physical attack.
CVE-2026-45648High· 8.8Windows Active Directory Domain Services Remote Code Execution Vulnerability
Stack-based buffer overflow in Active Directory Domain Services allows an authorized attacker to execute code over a network.
CVE-2026-45656High· 7.8UEFI Secure Boot Security Feature Bypass Vulnerability
Protection mechanism failure in Windows UEFI allows an authorized attacker to bypass a security feature locally.
CVE-2026-45655Medium· 5.3Windows BitLocker Security Feature Bypass Vulnerability
Protection mechanism failure in Windows BitLocker allows an unauthorized attacker to bypass a security feature with a physical attack.
CVE-2026-45657Critical· 9.8Windows Kernel Remote Code Execution Vulnerability
Use after free in Windows Kernel allows an unauthorized attacker to execute code over a network.
CVE-2026-47291Critical· 9.8HTTP.sys Remote Code Execution Vulnerability
Integer overflow or wraparound in Windows HTTP.sys allows an unauthorized attacker to execute code over a network.
CVE-2026-47289High· 8.8Remote Desktop Client Remote Code Execution Vulnerability
Heap-based buffer overflow in Remote Desktop Client allows an unauthorized attacker to execute code over a network.
CVE-2026-47288High· 7.1Windows Kerberos Key Distribution Center (KDC) Remote Code Execution
Integer overflow or wraparound in Windows Kerberos allows an authorized attacker to execute code over an adjacent network.
CVE-2026-41092High· 7.8Microsoft Kinect Elevation of Privilege Vulnerability
Improper access control in Microsoft Kinect allows an authorized attacker to elevate privileges locally.