Microsoft Windows Server 2022 23h2 vulnerabilities

1,676 CVEs affecting Microsoft Windows Server 2022 23h2, 59 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-42825, published 2026-05-12.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-59287: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability, published 2025-10-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-10-24. EPSS: 100% chance of exploitation in the next 30 days. Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
• CVE-2024-21412: Microsoft Windows Internet Shortcut Files Security Feature Bypass Vulnerability, published 2024-02-13. High severity, CVSS 8.1. Actively exploited: in CISA KEV since 2024-02-13. EPSS: 99.4% chance of exploitation in the next 30 days. Internet Shortcut Files Security Feature Bypass Vulnerability
• CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability, published 2025-06-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-06-10. EPSS: 87% chance of exploitation in the next 30 days. External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
• CVE-2024-43451: Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability, published 2024-11-12. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2024-11-12. EPSS: 85.4% chance of exploitation in the next 30 days. NTLM Hash Disclosure Spoofing Vulnerability
• CVE-2024-38112: Microsoft Windows MSHTML Platform Spoofing Vulnerability, published 2024-07-09. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2024-07-09. EPSS: 84.2% chance of exploitation in the next 30 days. Windows MSHTML Platform Spoofing Vulnerability
• CVE-2025-33073: Microsoft Windows SMB Client Improper Access Control Vulnerability, published 2025-06-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-10-20. EPSS: 82.7% chance of exploitation in the next 30 days. Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
• CVE-2024-30088: Microsoft Windows Kernel TOCTOU Race Condition Vulnerability, published 2024-06-11. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2024-10-15. EPSS: 68.2% chance of exploitation in the next 30 days. Windows Kernel Elevation of Privilege Vulnerability
• CVE-2024-43572: Microsoft Windows Management Console Remote Code Execution Vulnerability, published 2024-10-08. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-10-08. EPSS: 66.7% chance of exploitation in the next 30 days. Microsoft Management Console Remote Code Execution Vulnerability
• CVE-2025-24054: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability, published 2025-03-11. Medium severity, CVSS 5.4. Actively exploited: in CISA KEV since 2025-04-17. EPSS: 62.3% chance of exploitation in the next 30 days. External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
• CVE-2024-21338: Microsoft Windows Kernel Exposed IOCTL with Insufficient Access Control Vulnerability, published 2024-02-13. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-03-04. EPSS: 59.8% chance of exploitation in the next 30 days. Windows Kernel Elevation of Privilege Vulnerability

Latest

• CVE-2026-42825, published 2026-05-12. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Windows Telephony Service allows an authorized attacker to elevate privileges locally.
• CVE-2026-41097, published 2026-05-12. Medium severity, CVSS 6.7. EPSS: 2.2% chance of exploitation in the next 30 days. Reliance on a component that is not updateable in Windows Secure Boot allows an authorized attacker to bypass a security feature locally.
• CVE-2026-41096, published 2026-05-12. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Heap-based buffer overflow in Microsoft Windows DNS allows an unauthorized attacker to execute code over a network.
• CVE-2026-41095, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Data Deduplication allows an authorized attacker to elevate privileges locally.
• CVE-2026-41089, published 2026-05-12. Critical severity, CVSS 9.8. EPSS: 1% chance of exploitation in the next 30 days. Stack-based buffer overflow in Windows Netlogon allows an unauthorized attacker to execute code over a network.
• CVE-2026-41088, published 2026-05-12. High severity, CVSS 7.8. EPSS: 0.4% chance of exploitation in the next 30 days. Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.
• CVE-2026-40415, published 2026-05-12. High severity, CVSS 8.1. EPSS: 0.7% chance of exploitation in the next 30 days. Use after free in Windows TCP/IP allows an unauthorized attacker to execute code over a network.
• CVE-2026-40414, published 2026-05-12. High severity, CVSS 7.4. EPSS: 0.6% chance of exploitation in the next 30 days. Windows TCP/IP Denial of Service Vulnerability
• CVE-2026-40413, published 2026-05-12. High severity, CVSS 7.4. EPSS: 0.6% chance of exploitation in the next 30 days. Windows TCP/IP Denial of Service Vulnerability
• CVE-2026-40410, published 2026-05-12. High severity, CVSS 7.0. EPSS: 0.3% chance of exploitation in the next 30 days. Use after free in Windows SMB Client allows an authorized attacker to elevate privileges locally.