Microsoft
Microsoft Windows Server 2008: vulnerabilidades y CVE
Microsoft Windows Server 2008 tiene 3552 vulnerabilidades publicadas, 87 de ellas en los últimos 12 meses. 104 son críticas y 148 figuran en el catálogo de explotación activa de CISA.
CVE3552
Últimos 12 meses87
Críticas104
Explotadas activamente148
Todas las vulnerabilidades en el catálogo →⭐ Seguir esta tecnología
🔴 Explotadas activamente (CISA KEV)
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2008-4250 | Crítica (9.8) | 99% | ⚠ Explotación activa | 23 oct 2008 | The Server service in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, Server 2008, and 7 Pre-Beta allows remote attackers to execute arbitrary code via a crafted RPC request that… |
| CVE-2023-36424 | Alta (7.8) | 12% | ⚠ Explotación activa | 14 nov 2023 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2025-33073 | Alta (8.8) | 83% | ⚠ Explotación activa | 10 jun 2025 | Improper access control in Windows SMB allows an authorized attacker to elevate privileges over a network. |
| CVE-2025-24990 | Alta (7.8) | 6.4% | ⚠ Explotación activa | 14 oct 2025 | Microsoft is aware of vulnerabilities in the third party Agere Modem driver that ships natively with supported Windows operating systems. This is an announcement of the upcoming removal of ltmdm64.sys driver. The driver… |
| CVE-2025-59230 | Alta (7.8) | 2.7% | ⚠ Explotación activa | 14 oct 2025 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
| CVE-2013-3918 | Alta (8.8) | 74% | ⚠ Explotación activa | 12 nov 2013 | The InformationCardSigninHelper Class ActiveX control in icardie.dll in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows… |
| CVE-2011-3402 | Alta (8.8) | 78% | ⚠ Explotación activa | 4 nov 2011 | Unspecified vulnerability in the TrueType font parsing engine in win32k.sys in the kernel-mode drivers in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2, R2, and R2… |
| CVE-2021-43226 | Alta (7.8) | 3.1% | ⚠ Explotación activa | 15 dic 2021 | Windows Common Log File System Driver Elevation of Privilege Vulnerability |
| CVE-2025-33053 | Alta (8.8) | 87% | ⚠ Explotación activa | 10 jun 2025 | External control of file name or path in Internet Shortcut Files allows an unauthorized attacker to execute code over a network. |
| CVE-2025-32706 | Alta (7.8) | 2.3% | ⚠ Explotación activa | 13 may 2025 | Improper input validation in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2025-32709 | Alta (7.8) | 2.1% | ⚠ Explotación activa | 13 may 2025 | Null pointer dereference in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2025-32701 | Alta (7.8) | 1.4% | ⚠ Explotación activa | 13 may 2025 | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2025-30397 | Alta (7.5) | 27% | ⚠ Explotación activa | 13 may 2025 | Access of resource using incompatible type ('type confusion') in Microsoft Scripting Engine allows an unauthorized attacker to execute code over a network. |
| CVE-2025-24054 | Media (5.4) | 59% | ⚠ Explotación activa | 11 mar 2025 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2025-29824 | Alta (7.8) | 14% | ⚠ Explotación activa | 8 abr 2025 | Use after free in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2025-24991 | Media (5.5) | 2.0% | ⚠ Explotación activa | 11 mar 2025 | Out-of-bounds read in Windows NTFS allows an authorized attacker to disclose information locally. |
| CVE-2025-26633 | Alta (7) | 30% | ⚠ Explotación activa | 11 mar 2025 | Improper neutralization in Microsoft Management Console allows an unauthorized attacker to bypass a security feature locally. |
| CVE-2025-24985 | Alta (7.8) | 3.8% | ⚠ Explotación activa | 11 mar 2025 | Integer overflow or wraparound in Windows Fast FAT Driver allows an unauthorized attacker to execute code locally. |
| CVE-2025-24983 | Alta (7) | 1.3% | ⚠ Explotación activa | 11 mar 2025 | Use after free in Windows Win32 Kernel Subsystem allows an authorized attacker to elevate privileges locally. |
| CVE-2025-24993 | Alta (7.8) | 2.2% | ⚠ Explotación activa | 11 mar 2025 | Heap-based buffer overflow in Windows NTFS allows an unauthorized attacker to execute code locally. |
Últimas vulnerabilidades
| CVE | Severidad | EPSS | Explotación activa | Publicada | Descripción |
|---|---|---|---|---|---|
| CVE-2026-20940 | Alta (7.8) | 0.46% | — | 13 ene 2026 | Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20936 | Media (4.3) | 0.49% | — | 13 ene 2026 | Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack. |
| CVE-2026-20931 | Alta (8) | 0.86% | — | 13 ene 2026 | External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network. |
| CVE-2026-20929 | Alta (7.5) | 2.9% | — | 13 ene 2026 | Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-20927 | Media (5.3) | 0.92% | — | 13 ene 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to deny service over a network. |
| CVE-2026-20925 | Media (6.5) | 18% | — | 13 ene 2026 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-20922 | Alta (7.8) | 1.1% | — | 13 ene 2026 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. |
| CVE-2026-20921 | Alta (7.5) | 1.2% | — | 13 ene 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-20875 | Alta (7.5) | 1.6% | — | 13 ene 2026 | Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network. |
| CVE-2026-20872 | Media (6.5) | 20% | — | 13 ene 2026 | External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network. |
| CVE-2026-20869 | Alta (7) | 0.30% | — | 13 ene 2026 | Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20868 | Alta (8.8) | 1.4% | — | 13 ene 2026 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
| CVE-2026-20860 | Alta (7.8) | 8.4% | — | 13 ene 2026 | Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20849 | Alta (7.5) | 1.0% | — | 13 ene 2026 | Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to elevate privileges over a network. |
| CVE-2026-20847 | Media (6.5) | 1.4% | — | 13 ene 2026 | Exposure of sensitive information to an unauthorized actor in Windows Shell allows an authorized attacker to perform spoofing over a network. |
| CVE-2026-20843 | Alta (7.8) | 3.5% | — | 13 ene 2026 | Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20840 | Alta (7.8) | 4.7% | — | 13 ene 2026 | Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally. |
| CVE-2026-20839 | Media (5.5) | 0.49% | — | 13 ene 2026 | Improper access control in Windows Client-Side Caching (CSC) Service allows an authorized attacker to disclose information locally. |
| CVE-2026-20834 | Media (4.6) | 0.75% | — | 13 ene 2026 | Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack. |
| CVE-2026-20833 | Media (5.5) | 0.54% | — | 13 ene 2026 | Use of a broken or risky cryptographic algorithm in Windows Kerberos allows an authorized attacker to disclose information locally. |
| CVE-2026-20831 | Alta (7) | 0.30% | — | 13 ene 2026 | Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20828 | Media (4.6) | 0.65% | — | 13 ene 2026 | Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical attack. |
| CVE-2026-20821 | Media (6.2) | 0.71% | — | 13 ene 2026 | Exposure of sensitive information to an unauthorized actor in Windows Remote Procedure Call allows an unauthorized attacker to disclose information locally. |
| CVE-2026-20820 | Alta (7.8) | 2.6% | — | 13 ene 2026 | Heap-based buffer overflow in Windows Common Log File System Driver allows an authorized attacker to elevate privileges locally. |
| CVE-2026-20816 | Alta (7) | 2.5% | — | 13 ene 2026 | Time-of-check time-of-use (toctou) race condition in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2026-0386 | Alta (7.5) | 0.56% | — | 13 ene 2026 | Improper access control in Windows Deployment Services allows an unauthorized attacker to execute code over an adjacent network. |
| CVE-2025-64678 | Alta (8.8) | 1.0% | — | 9 dic 2025 | Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
| CVE-2025-62571 | Alta (7.8) | 0.40% | — | 9 dic 2025 | Improper input validation in Windows Installer allows an authorized attacker to elevate privileges locally. |
| CVE-2025-62549 | Alta (8.8) | 1.3% | — | 9 dic 2025 | Untrusted pointer dereference in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network. |
| CVE-2025-62474 | Alta (7.8) | 0.37% | — | 9 dic 2025 | Improper access control in Windows Remote Access Connection Manager allows an authorized attacker to elevate privileges locally. |
🎯 Cómo se explota (técnicas ATT&CK)
Número de CVE de esta tecnología asignadas a cada técnica de explotación o de impacto principal.