Microsoft Windows Server 2025 vulnerabilities

CVE-2026-88072 High · 7.8 CWE-59 Oct 13, 2026

Windows Host Guardian Service Elevation of Privilege Vulnerability

Improper access control in Windows Host Guardian Service allows an authorized attacker to elevate privileges locally.

CVE-2026-88071 High · 7.8 CWE-415 Oct 13, 2026

Windows Hyper-V Elevation of Privilege Vulnerability

Double free in Windows Hyper-V allows an authorized attacker to elevate privileges locally.

CVE-2026-88070 High · 7.8 CWE-125 Oct 13, 2026

Windows BitLocker Elevation of Privilege Vulnerability

Out-of-bounds read in Windows BitLocker allows an authorized attacker to elevate privileges locally.

CVE-2026-87716 High · 7.5 CWE-122 Oct 13, 2026

Windows Storage Spaces Controller Denial of Service Vulnerability

Heap-based buffer overflow in Windows Storage Spaces Controller allows an unauthorized attacker to deny service over a network.

CVE-2026-87715 High · 7.0 CWE-416 Oct 13, 2026

Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-87714 Medium · 6.5 CWE-862 Oct 13, 2026

WebDAV Security Feature Bypass Vulnerability

Missing authorization in WebDAV allows an authorized attacker to bypass a security feature over a network.

CVE-2026-87713 High · 7.5 CWE-416 Oct 13, 2026

Windows Bluetooth Port Driver Remote Code Execution

Use after free in Windows Bluetooth Port Driver allows an unauthorized attacker to elevate privileges over an adjacent network.

CVE-2026-87712 High · 7.8 CWE-416 Oct 13, 2026

Microsoft Windows QoS Scheduler Driver Elevation of Privilege Vulnerability

Use after free in Windows Quality of Service (QoS) Packet Scheduler allows an authorized attacker to elevate privileges locally.

CVE-2026-87711 High · 7.8 CWE-121 Oct 13, 2026

Windows Installer Elevation of Privilege Vulnerability

Stack-based buffer overflow in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-87710 High · 7.0 CWE-362 Oct 13, 2026

Microsoft Local Security Authority (LSA) Server Elevation of Privilege Vulnerability

Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an authorized attacker to elevate privileges locally.

CVE-2026-87709 Medium · 5.5 CWE-250 Oct 13, 2026

Windows Host Guardian Service Tampering Vulnerability

Improper access control in Windows Host Guardian Service allows an authorized attacker to perform tampering locally.

CVE-2026-87708 High · 7.0 CWE-416 Oct 13, 2026

Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-87707 High · 7.8 CWE-122 Oct 13, 2026

Windows Fax and Scan Service Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Fax and Scan Service allows an authorized attacker to elevate privileges locally.

CVE-2026-87706 High · 7.8 CWE-122 Oct 13, 2026

Windows Storage Spaces Controller Elevation of Privilege Vulnerability

Heap-based buffer overflow in Windows Storage Spaces Controller allows an authorized attacker to elevate privileges locally.

CVE-2026-87705 High · 7.4 CWE-940 Oct 13, 2026

Windows Hyper-V Security Feature Bypass Vulnerability

Improper verification of source of a communication channel in Windows Hyper-V allows an unauthorized attacker to bypass a security feature over an adjacent network.

CVE-2026-87704 High · 7.0 CWE-416 Oct 13, 2026

Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-87702 High · 7.8 CWE-190 Oct 13, 2026

Windows Resource Management (MRM) Elevation of Privilege Vulnerability

Integer overflow or wraparound in Windows Resource Management (MRM) allows an authorized attacker to elevate privileges locally.

CVE-2026-87700 High · 7.8 CWE-416 Oct 13, 2026

Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-87699 High · 7.8 CWE-122 Oct 13, 2026

Winlogon Elevation of Privilege Vulnerability

Heap-based buffer overflow in Winlogon allows an authorized attacker to elevate privileges locally.

CVE-2026-87698 Medium · 5.5 CWE-125 Oct 13, 2026

Windows Remote Access Service Infrastructure Information Disclosure Vulnerability

Out-of-bounds read in Windows Remote Access Service Infrastructure allows an authorized attacker to disclose information locally.

CVE-2026-87694 High · 7.8 CWE-416 Oct 13, 2026

Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-87693 High · 7.0 CWE-416 Oct 13, 2026

Windows Installer Elevation of Privilege Vulnerability

Use after free in Windows Installer allows an authorized attacker to elevate privileges locally.

CVE-2026-87691 High · 7.8 CWE-416 Oct 13, 2026

Windows Management Services Elevation of Privilege Vulnerability

Use after free in Windows Management Services allows an authorized attacker to elevate privileges locally.

CVE-2026-85945 High · 7.8 CWE-416 Oct 13, 2026

Windows Kernel Elevation of Privilege Vulnerability

Use after free in Windows Kernel allows an authorized attacker to elevate privileges locally.

CVE-2026-85943 High · 7.0 CWE-122 Oct 13, 2026

Reliable Multicast Transport Driver (RMCAST) Elevation of Privilege Vulnerability

Time-of-check time-of-use (toctou) race condition in Reliable Multicast Transport Driver (RMCAST) allows an authorized attacker to elevate privileges locally.