Microsoft Windows Server 2019

Don't miss out!

Thousands of developers use stack.watch to stay informed.
Get an email whenever new security vulnerabilities are reported in Microsoft Windows Server 2019.

By the Year

In 2026 there have been 93 vulnerabilities in Microsoft Windows Server 2019 with an average score of 7.1 out of ten. Last year, in 2025 Windows Server 2019 had 685 security vulnerabilities published. Right now, Windows Server 2019 is on track to have less security vulnerabilities in 2026 than it did last year. Last year, the average CVE base score was greater by 0.18

Year	Vulnerabilities	Average Score
2026	93	7.06
2025	685	7.24
2024	581	7.43
2023	548	7.50
2022	553	7.42
2021	469	7.39
2020	757	7.35
2019	454	7.29
2018	54	7.17

It may take a day or so for new Windows Server 2019 vulnerabilities to show up in the stats or in the list of recent security vulnerabilities. Additionally vulnerabilities may be tagged under a different product or component name.

Recent Microsoft Windows Server 2019 Security Vulnerabilities

Feb 2026: GDI+ Denial of Service Vulnerability
CVE-2026-20846 7.5 - High - February 10, 2026

Buffer over-read in Windows GDI+ allows an unauthorized attacker to deny service over a network.

Buffer Over-read

Feb 2026: Windows Kernel Information Disclosure Vulnerability
CVE-2026-21222 5.5 - Medium - February 10, 2026

Insertion of sensitive information into log file in Windows Kernel allows an authorized attacker to disclose information locally.

Insertion of Sensitive Information into Log File

Feb 2026: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-21231 7.8 - High - February 10, 2026

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Kernel allows an authorized attacker to elevate privileges locally.

Race Condition

Feb 2026: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-21238 7.8 - High - February 10, 2026

Improper access control in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Authorization

Feb 2026: Windows Kernel Elevation of Privilege Vulnerability
CVE-2026-21239 7.8 - High - February 10, 2026

Heap-based buffer overflow in Windows Kernel allows an authorized attacker to elevate privileges locally.

Heap-based Buffer Overflow

Feb 2026: Windows HTTP.sys Elevation of Privilege Vulnerability
CVE-2026-21240 7.8 - High - February 10, 2026

Time-of-check time-of-use (toctou) race condition in Windows HTTP.sys allows an authorized attacker to elevate privileges locally.

TOCTTOU

Feb 2026: Windows Lightweight Directory Access Protocol (LDAP) Denial of Service Vulnerability
CVE-2026-21243 7.5 - High - February 10, 2026

Null pointer dereference in Windows LDAP - Lightweight Directory Access Protocol allows an unauthorized attacker to deny service over a network.

NULL Pointer Dereference

Feb 2026: Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-21244 7.3 - High - February 10, 2026

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

Heap-based Buffer Overflow

Feb 2026: Windows NTLM Spoofing Vulnerability
CVE-2026-21249 3.3 - Low - February 10, 2026

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing locally.

External Control of File Name or Path

Feb 2026: Cluster Client Failover (CCF) Elevation of Privilege Vulnerability
CVE-2026-21251 7.8 - High - February 10, 2026

Use after free in Windows Cluster Client Failover allows an authorized attacker to elevate privileges locally.

Dangling pointer

Feb 2026: Windows Hyper-V Security Feature Bypass Vulnerability
CVE-2026-21255 8.8 - High - February 10, 2026

Improper access control in Windows Hyper-V allows an authorized attacker to bypass a security feature locally.

Authorization

Feb 2026: Mailslot File System Elevation of Privilege Vulnerability
CVE-2026-21253 7 - High - February 10, 2026

Use after free in Mailslot File System allows an authorized attacker to elevate privileges locally.

Dangling pointer

Feb 2026: Windows Storage Elevation of Privilege Vulnerability
CVE-2026-21508 7 - High - February 10, 2026

Improper authentication in Windows Storage allows an authorized attacker to elevate privileges locally.

authentification

Feb 2026: Windows Remote Access Connection Manager Denial of Service Vulnerability
CVE-2026-21525 6.2 - Medium - February 10, 2026

Null pointer dereference in Windows Remote Access Connection Manager allows an unauthorized attacker to deny service locally.

NULL Pointer Dereference

Feb 2026: Windows Shell Security Feature Bypass Vulnerability
CVE-2026-21510 8.8 - High - February 10, 2026

Protection mechanism failure in Windows Shell allows an unauthorized attacker to bypass a security feature over a network.

Protection Mechanism Failure

Feb 2026: MSHTML Framework Security Feature Bypass Vulnerability
CVE-2026-21513 8.8 - High - February 10, 2026

Protection mechanism failure in MSHTML Framework allows an unauthorized attacker to bypass a security feature over a network.

Protection Mechanism Failure

Feb 2026: Windows Remote Desktop Services Elevation of Privilege Vulnerability
CVE-2026-21533 7.8 - High - February 10, 2026

Improper privilege management in Windows Remote Desktop allows an authorized attacker to elevate privileges locally.

Improper Privilege Management

Feb 2026: Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability
CVE-2026-21236 7.8 - High - February 10, 2026

Heap-based buffer overflow in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

Heap-based Buffer Overflow

Feb 2026: Windows Connected Devices Platform Service Elevation of Privilege Vulnerability
CVE-2026-21234 7 - High - February 10, 2026

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Connected Devices Platform Service allows an authorized attacker to elevate privileges locally.

Race Condition

Feb 2026: Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2026-21235 7.3 - High - February 10, 2026

Use after free in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Dangling pointer

Feb 2026: Windows Graphics Component Elevation of Privilege Vulnerability
CVE-2026-21246 7.8 - High - February 10, 2026

Heap-based buffer overflow in Microsoft Graphics Component allows an authorized attacker to elevate privileges locally.

Heap-based Buffer Overflow

Feb 2026: Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-21248 7.3 - High - February 10, 2026

Heap-based buffer overflow in Windows Hyper-V allows an authorized attacker to execute code locally.

Heap-based Buffer Overflow

Feb 2026: Windows Hyper-V Remote Code Execution Vulnerability
CVE-2026-21247 7.3 - High - February 10, 2026

Improper input validation in Windows Hyper-V allows an authorized attacker to execute code locally.

Improper Input Validation

Feb 2026: Desktop Window Manager Elevation of Privilege Vulnerability
CVE-2026-21519 7.8 - High - February 10, 2026

Access of resource using incompatible type ('type confusion') in Desktop Window Manager allows an authorized attacker to elevate privileges locally.

Object Type Confusion

Jan 2026: Windows File Explorer Information Disclosure Vulnerability
CVE-2026-20939 5.5 - Medium - January 13, 2026

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

Information Disclosure

Jan 2026: Windows File Explorer Information Disclosure Vulnerability
CVE-2026-20937 5.5 - Medium - January 13, 2026

Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an authorized attacker to disclose information locally.

Information Disclosure

Jan 2026: Windows NDIS Information Disclosure Vulnerability
CVE-2026-20936 4.3 - Medium - January 13, 2026

Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack.

Out-of-bounds Read

Jan 2026: Windows Telephony Service Elevation of Privilege Vulnerability
CVE-2026-20931 8 - High - January 13, 2026

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.

External Control of File Name or Path

Jan 2026: Windows HTTP.sys Elevation of Privilege Vulnerability
CVE-2026-20929 7.5 - High - January 13, 2026

Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.

Authorization