Microsoft Windows Server 2004 vulnerabilities

28 CVEs affecting Microsoft Windows Server 2004, 27 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-50508, published 2026-06-09.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2021-31166: Microsoft HTTP Protocol Stack Remote Code Execution Vulnerability, published 2021-05-11. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2022-04-06. EPSS: 99.9% chance of exploitation in the next 30 days. HTTP Protocol Stack Remote Code Execution Vulnerability
• CVE-2020-1472: Microsoft Netlogon Privilege Escalation Vulnerability, published 2020-08-17. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 99.4% chance of exploitation in the next 30 days. An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protocol (MS-NRPC). An…
• CVE-2021-40444: Microsoft MSHTML Remote Code Execution Vulnerability, published 2021-09-15. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 97.8% chance of exploitation in the next 30 days. Microsoft is investigating reports of a remote code execution vulnerability in MSHTML that affects Microsoft Windows. Microsoft is aware of targeted attacks that attempt to exploit this vulnerability…
• CVE-2021-1675: Microsoft Windows Print Spooler Remote Code Execution Vulnerability, published 2021-06-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 85.3% chance of exploitation in the next 30 days. Windows Print Spooler Remote Code Execution Vulnerability
• CVE-2021-31955: Microsoft Windows Kernel Information Disclosure Vulnerability, published 2021-06-08. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 81.1% chance of exploitation in the next 30 days. Windows Kernel Information Disclosure Vulnerability
• CVE-2021-1732: Microsoft Win32k Privilege Escalation Vulnerability, published 2021-02-25. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 78.4% chance of exploitation in the next 30 days. Windows Win32k Elevation of Privilege Vulnerability
• CVE-2021-42287: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability, published 2021-11-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-04-11. EPSS: 77.2% chance of exploitation in the next 30 days. Active Directory Domain Services Elevation of Privilege Vulnerability
• CVE-2021-40449: Microsoft Windows Win32k Privilege Escalation Vulnerability, published 2021-10-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-17. EPSS: 74.1% chance of exploitation in the next 30 days. Win32k Elevation of Privilege Vulnerability
• CVE-2021-42278: Microsoft Active Directory Domain Services Privilege Escalation Vulnerability, published 2021-11-10. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2022-04-11. EPSS: 73.3% chance of exploitation in the next 30 days. Active Directory Domain Services Elevation of Privilege Vulnerability
• CVE-2021-36942: Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability, published 2021-08-12. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 66% chance of exploitation in the next 30 days. Windows LSA Spoofing Vulnerability

Latest

• CVE-2026-50508, published 2026-06-09. High severity, CVSS 7.5. EPSS: 0.9% chance of exploitation in the next 30 days. Exposure of sensitive information to an unauthorized actor in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
• CVE-2021-43226: Microsoft Windows Privilege Escalation Vulnerability, published 2021-12-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2025-10-06. EPSS: 3.3% chance of exploitation in the next 30 days. Windows Common Log File System Driver Elevation of Privilege Vulnerability
• CVE-2021-41379: Microsoft Windows Installer Privilege Escalation Vulnerability, published 2021-11-10. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2022-03-03. EPSS: 19.5% chance of exploitation in the next 30 days. Windows Installer Elevation of Privilege Vulnerability
• CVE-2021-41357: Microsoft Win32k Privilege Escalation Vulnerability, published 2021-10-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-25. EPSS: 1.6% chance of exploitation in the next 30 days. Win32k Elevation of Privilege Vulnerability
• CVE-2021-40450: Microsoft Win32k Privilege Escalation Vulnerability, published 2021-10-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2022-04-25. EPSS: 1.6% chance of exploitation in the next 30 days. Win32k Elevation of Privilege Vulnerability
• CVE-2021-36955: Microsoft Windows Common Log File System (CLFS) Driver Privilege Escalation Vulnerability, published 2021-09-15. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2021-11-03. EPSS: 4.1% chance of exploitation in the next 30 days. Windows Common Log File System Driver Elevation of Privilege Vulnerability