windows_server_2022_23h2_edition_server_core_installation vulnerabilities
CVEs whose affected-version data names the windows_server_2022_23h2_edition_server_core_installation package. Each record lists the affected and patched versions; check a specific version with the dependency checker or POST /api/sbom.
114 CVEsRSS
CVE-2026-20930High· 7.8Windows Management Services Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Management Services allows an authorized attacker to elevate privileges locally.
CVE-2026-25184High· 7.0Applocker Filter Driver (applockerfltr.sys) Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Applocker Filter Driver (applockerfltr.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-26154High· 7.5Windows Server Update Service (WSUS) Tampering Vulnerability
Improper input validation in Windows Server Update Service allows an unauthorized attacker to perform tampering over a network.
CVE-2026-23670Medium· 5.7Windows Virtualization-Based Security (VBS) Security Feature Bypass Vulnerability
Untrusted pointer dereference in Windows Virtualization-Based Security (VBS) Enclave allows an authorized attacker to bypass a security feature locally.
CVE-2026-26161High· 7.8Windows Sensor Data Service Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Sensor Data Service allows an authorized attacker to elevate privileges locally.
CVE-2026-26160High· 7.8Remote Desktop Licensing Service Elevation of Privilege Vulnerability
Missing authentication for critical function in Windows Remote Desktop Licensing Service allows an authorized attacker to elevate privileges locally.
CVE-2026-26151High· 7.1Remote Desktop Spoofing Vulnerability
Insufficient ui warning of dangerous operations in Windows Remote Desktop allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-26165High· 7.0Windows Shell Elevation of Privilege Vulnerability
Use after free in Windows Shell allows an authorized attacker to elevate privileges locally.
CVE-2026-26162High· 7.8Windows OLE Elevation of Privilege Vulnerability
Access of resource using incompatible type ('type confusion') in Windows OLE allows an authorized attacker to elevate privileges locally.
CVE-2026-26155Medium· 6.5Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
Microsoft Local Security Authority Subsystem Service Information Disclosure Vulnerability
CVE-2026-26180High· 7.8Windows Kernel Elevation of Privilege Vulnerability
Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-26175Medium· 4.6Windows Boot Manager Security Feature Bypass Vulnerability
Use of uninitialized resource in Windows Boot Manager allows an unauthorized attacker to bypass a security feature with a physical attack.
CVE-2026-26167High· 8.8Windows Push Notifications Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Push Notifications allows an authorized attacker to elevate privileges locally.
CVE-2026-26166High· 7.0Windows Shell Elevation of Privilege Vulnerability
Double free in Windows Shell allows an authorized attacker to elevate privileges locally.
CVE-2026-26183High· 7.8Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability
Improper access control in Windows RPC API allows an authorized attacker to elevate privileges locally.
CVE-2026-26181High· 7.8Microsoft Brokering File System Elevation of Privilege Vulnerability
Use after free in Microsoft Brokering File System allows an authorized attacker to elevate privileges locally.
CVE-2026-26179High· 7.8PoCWindows Kernel Elevation of Privilege Vulnerability
Double free in Windows Kernel allows an authorized attacker to elevate privileges locally.
CVE-2026-27915High· 7.8Windows UPnP Device Host Elevation of Privilege Vulnerability
Use after free in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
CVE-2026-27908High· 7.0Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability
Use after free in Windows TDI Translation Driver (tdx.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-27907High· 7.8Windows Storage Spaces Controller Elevation of Privilege Vulnerability
Integer underflow (wrap or wraparound) in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.
CVE-2026-27926High· 7.0Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.
CVE-2026-27921High· 7.0Windows TDI Translation Driver (tdx.sys) Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows TCP/IP allows an authorized attacker to elevate privileges locally.
CVE-2026-27917High· 7.0Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) Elevation of Privilege Vulnerability
Use after free in Windows WFP NDIS Lightweight Filter Driver (wfplwfs.sys) allows an authorized attacker to elevate privileges locally.
CVE-2026-27931Medium· 5.5Windows GDI Information Disclosure Vulnerability
Out-of-bounds read in Windows GDI allows an unauthorized attacker to disclose information locally.
CVE-2026-27919High· 7.8Windows UPnP Device Host Elevation of Privilege Vulnerability
Untrusted pointer dereference in Windows Universal Plug and Play (UPnP) Device Host allows an authorized attacker to elevate privileges locally.
CVE-2026-27918High· 7.8Windows Shell Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Shell allows an authorized attacker to elevate privileges locally.
CVE-2026-32071High· 7.5Windows Local Security Authority Subsystem Service (LSASS) Denial of Service Vulnerability
Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.
CVE-2026-27927High· 7.8Windows Projected File System Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Projected File System allows an authorized attacker to elevate privileges locally.
CVE-2026-27924High· 7.8Desktop Window Manager Elevation of Privilege Vulnerability
Use after free in Desktop Window Manager allows an authorized attacker to elevate privileges locally.
CVE-2026-32082High· 7.0Windows Simple Search and Discovery Protocol (SSDP) Service Elevation of Privilege Vulnerability
Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SSDP Service allows an authorized attacker to elevate privileges locally.