Microsoft Windows Server 1709 vulnerabilities

14 CVEs affecting Microsoft Windows Server 1709, 11 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2019-1064, published 2019-06-12.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2018-0824: Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability, published 2018-05-09. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2024-08-05. EPSS: 73.2% chance of exploitation in the next 30 days. A remote code execution vulnerability exists in "Microsoft COM for Windows" when it fails to properly handle serialized objects, aka "Microsoft COM for Windows Remote Code Execution Vulnerability."…
CVE-2018-8414: Microsoft Windows Shell Remote Code Execution Vulnerability, published 2018-08-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2022-03-25. EPSS: 72.9% chance of exploitation in the next 30 days. A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers,…
CVE-2018-8453: Microsoft Win32k Privilege Escalation Vulnerability, published 2018-10-10. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-01-21. EPSS: 70% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k Elevation of Privilege Vulnerability." This affects Windows…
CVE-2019-0803: Microsoft Win32k Privilege Escalation Vulnerability, published 2019-04-09. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 45.2% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is…
CVE-2019-0703: Microsoft Windows SMB Information Disclosure Vulnerability, published 2019-04-09. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2022-05-23. EPSS: 9.6% chance of exploitation in the next 30 days. An information disclosure vulnerability exists in the way that the Windows SMB Server handles certain requests, aka 'Windows SMB Information Disclosure Vulnerability'. This CVE ID is unique from…
CVE-2019-1064: Microsoft Windows AppX Deployment Service (AppXSVC) Privilege Escalation Vulnerability, published 2019-06-12. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-15. EPSS: 6.9% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when Windows AppX Deployment Service (AppXSVC) improperly handles hard links. An attacker who successfully exploited this vulnerability could run…
CVE-2019-0543: Microsoft Windows Privilege Escalation Vulnerability, published 2019-01-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-15. EPSS: 4.7% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when Windows improperly handles authentication requests, aka "Microsoft Windows Elevation of Privilege Vulnerability." This affects Windows 7, Windows…
CVE-2019-0859: Microsoft Win32k Privilege Escalation Vulnerability, published 2019-04-09. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 4.2% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is…
CVE-2018-8406: Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability, published 2018-08-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 3.4% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege…
CVE-2018-8405: Microsoft DirectX Graphics Kernel Privilege Escalation Vulnerability, published 2018-08-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-03-28. EPSS: 3.4% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when the DirectX Graphics Kernel (DXGKRNL) driver improperly handles objects in memory, aka "DirectX Graphics Kernel Elevation of Privilege…

Latest

CVE-2019-0797: Microsoft Win32k Privilege Escalation Vulnerability, published 2019-04-09. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 1.9% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka 'Win32k Elevation of Privilege Vulnerability'. This CVE ID is…
CVE-2018-8493, published 2018-10-10. High severity, CVSS 7.5. EPSS: 8.4% chance of exploitation in the next 30 days. An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP Information Disclosure Vulnerability." This affects Windows…