Microsoft Windows Server 2025 vulnerabilities

3,643 CVEs affecting Microsoft Windows Server 2025, 42 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2026-97844, published 2026-10-13.

More from Microsoft.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

• CVE-2025-59287: Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability, published 2025-10-14. Critical severity, CVSS 9.8. Actively exploited: in CISA KEV since 2025-10-24. EPSS: 100% chance of exploitation in the next 30 days. Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
• CVE-2025-33053: Microsoft Windows External Control of File Name or Path Vulnerability, published 2025-06-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-06-10. EPSS: 87% chance of exploitation in the next 30 days. External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network.
• CVE-2024-43451: Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability, published 2024-11-12. Medium severity, CVSS 6.5. Actively exploited: in CISA KEV since 2024-11-12. EPSS: 85.4% chance of exploitation in the next 30 days. NTLM Hash Disclosure Spoofing Vulnerability
• CVE-2025-33073: Microsoft Windows SMB Client Improper Access Control Vulnerability, published 2025-06-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2025-10-20. EPSS: 82.7% chance of exploitation in the next 30 days. Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network.
• CVE-2025-24054: Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability, published 2025-03-11. Medium severity, CVSS 5.4. Actively exploited: in CISA KEV since 2025-04-17. EPSS: 62.3% chance of exploitation in the next 30 days. External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.
• CVE-2013-3900: Microsoft WinVerifyTrust function Remote Code Execution, published 2013-12-11. Medium severity, CVSS 5.5. Actively exploited: in CISA KEV since 2022-01-10. EPSS: 44.6% chance of exploitation in the next 30 days. Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the…
• CVE-2025-26633: Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability, published 2025-03-11. High severity, CVSS 7.0. Actively exploited: in CISA KEV since 2025-03-11. EPSS: 30.4% chance of exploitation in the next 30 days. Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally.
• CVE-2025-30397: Microsoft Windows Scripting Engine Type Confusion Vulnerability, published 2025-05-13. High severity, CVSS 7.5. Actively exploited: in CISA KEV since 2025-05-13. EPSS: 27% chance of exploitation in the next 30 days. Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network.
• CVE-2024-49138: Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability, published 2024-12-12. High severity, CVSS 7.8. Actively exploited: in CISA KEV since 2024-12-10. EPSS: 26.2% chance of exploitation in the next 30 days. Windows Common Log File System Driver Elevation of Privilege Vulnerability
• CVE-2026-21510: Microsoft Windows Shell Protection Mechanism Failure Vulnerability, published 2026-02-10. High severity, CVSS 8.8. Actively exploited: in CISA KEV since 2026-02-10. EPSS: 24.5% chance of exploitation in the next 30 days. Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Latest

• CVE-2026-97844, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97843, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97842, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.6% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97841, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97840, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97839, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97838, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97837, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97836, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.
• CVE-2026-97835, published 2026-10-13. Medium severity, CVSS 6.5. EPSS: 0.7% chance of exploitation in the next 30 days. Out-of-bounds read in DNS Server allows an authorized attacker to disclose information over a network.