Microsoft Windows Server 2016 vulnerabilities

5,040 published CVEs name Microsoft Windows Server 2016 among the affected products; CISA lists 119 of them as exploited in the wild.

Critical 165High 3,509Medium 1,351Low 15Not scored 0

CVEs per yearBy the year they were published

CVE-2026-96951
Windows Shell Security Feature Bypass Vulnerability
Microsoft · Microsoft Edge (Chromium-based)
ExploitedHigh8.8
CVE-2026-85880
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh7.8
CVE-2026-33824
Windows Internet Key Exchange (IKE) Service Extensions Remote Code Execution Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedCritical9.8
CVE-2026-68820
Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh7.0
CVE-2026-56155
Active Directory Federation Services Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh7.8
CVE-2026-32202
Windows Shell Spoofing Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedMedium4.3
CVE-2023-36424
Windows Common Log File System Driver Elevation of Privilege Vulnerability
Microsoft · Windows 11 version 22H3
ExploitedHigh7.8
CVE-2026-21525
Windows Remote Access Connection Manager Denial of Service Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedMedium6.2
CVE-2026-21510
Windows Shell Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh8.8
CVE-2026-21513
MSHTML Framework Security Feature Bypass Vulnerability
Microsoft · Windows 10 Version 1607
ExploitedHigh8.8

CVE-2026-108136
Microsoft Windows Search Component Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
High7.8
CVE-2026-108132
Windows Kerberos Elevation of Privilege Vulnerability
Microsoft · Windows 10 Version 1607
High7.0
CVE-2026-108131
Active Directory Federation Services (AD FS) Spoofing Vulnerability
Microsoft · Windows 10 Version 1607
High7.5
CVE-2026-108129
Role: DNS Server Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1607
Medium6.5
CVE-2026-108128
Role: DNS Server Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1607
Medium6.5
CVE-2026-108127
Role: DNS Server Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1607
Medium6.5
CVE-2026-97844
Role: DNS Server Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1607
Medium6.5
CVE-2026-97843
Role: DNS Server Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1607
Medium6.5
CVE-2026-97842
Role: DNS Server Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1607
Medium6.5
CVE-2026-97841
Role: DNS Server Information Disclosure Vulnerability
Microsoft · Windows 10 Version 1607
Medium6.5