# Windows Server 2012 vulnerabilities > Windows Server 2012 is made by Microsoft. We track 3,842 published vulnerabilities in it, across 7 versions. 198 of them are on the list of flaws known to be exploited, the newest added on 8 September 2026. If you run Windows Server 2012, check your version against the exploited flaws below and patch those first. Canonical page: https://www.precursorintelligence.com/product/microsoft/windows_server_2012 ## At a glance - **Made by:** [Microsoft](https://www.precursorintelligence.com/vendors/microsoft) - **Published vulnerabilities:** 3,842 - **Known to be exploited:** 198 - **Versions tracked:** 7 - **Most recently added to the known-exploited list:** [CVE-2026-85880](https://www.precursorintelligence.com/what-is/cve-2026-85880), 8 September 2026. We keep watching the list. ## Which versions of Windows Server 2012 do the exploited flaws hit? Each exploited flaw lists the versions it affects, as published. - [CVE-2026-85880](https://www.precursorintelligence.com/what-is/cve-2026-85880) (Microsoft Windows Heap-Based Buffer Overflow Vulnerability): r2 - [CVE-2026-56155](https://www.precursorintelligence.com/what-is/cve-2026-56155) (Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability): r2 - [CVE-2023-36424](https://www.precursorintelligence.com/what-is/cve-2023-36424) (Microsoft Windows Out-of-Bounds Read Vulnerability): r2 - [CVE-2025-59287](https://www.precursorintelligence.com/what-is/cve-2025-59287) (Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability): r2 - [CVE-2025-33073](https://www.precursorintelligence.com/what-is/cve-2025-33073) (Microsoft Windows SMB Client Improper Access Control Vulnerability): r2 - [CVE-2025-47827](https://www.precursorintelligence.com/what-is/cve-2025-47827) (IGEL OS Use of a Key Past its Expiration Date Vulnerability): r2 - [CVE-2025-24990](https://www.precursorintelligence.com/what-is/cve-2025-24990) (Microsoft Windows Untrusted Pointer Dereference Vulnerability): r2 - [CVE-2025-59230](https://www.precursorintelligence.com/what-is/cve-2025-59230) (Microsoft Windows Improper Access Control Vulnerability): r2 - [CVE-2013-3918](https://www.precursorintelligence.com/what-is/cve-2013-3918) (Microsoft Windows Out-of-Bounds Write Vulnerability): r2 - [CVE-2021-43226](https://www.precursorintelligence.com/what-is/cve-2021-43226) (Microsoft Windows Privilege Escalation Vulnerability): r2 - [CVE-2025-33053](https://www.precursorintelligence.com/what-is/cve-2025-33053) (Microsoft Windows External Control of File Name or Path Vulnerability): r2 - [CVE-2025-30397](https://www.precursorintelligence.com/what-is/cve-2025-30397) (Microsoft Windows Scripting Engine Type Confusion Vulnerability): r2 - [CVE-2025-32701](https://www.precursorintelligence.com/what-is/cve-2025-32701) (Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability): r2 - [CVE-2025-32706](https://www.precursorintelligence.com/what-is/cve-2025-32706) (Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability): r2 - [CVE-2025-32709](https://www.precursorintelligence.com/what-is/cve-2025-32709) (Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability): r2 - [CVE-2025-24054](https://www.precursorintelligence.com/what-is/cve-2025-24054) (Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability): r2 - [CVE-2025-29824](https://www.precursorintelligence.com/what-is/cve-2025-29824) (Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability): r2 - [CVE-2025-24984](https://www.precursorintelligence.com/what-is/cve-2025-24984) (Microsoft Windows NTFS Information Disclosure Vulnerability): r2 - [CVE-2025-26633](https://www.precursorintelligence.com/what-is/cve-2025-26633) (Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability): r2 - [CVE-2025-24993](https://www.precursorintelligence.com/what-is/cve-2025-24993) (Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability): r2 - [CVE-2025-24985](https://www.precursorintelligence.com/what-is/cve-2025-24985) (Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability): r2 - [CVE-2025-24983](https://www.precursorintelligence.com/what-is/cve-2025-24983) (Microsoft Windows Win32k Use-After-Free Vulnerability): r2 - [CVE-2025-24991](https://www.precursorintelligence.com/what-is/cve-2025-24991) (Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability): r2 - [CVE-2018-8639](https://www.precursorintelligence.com/what-is/cve-2018-8639) (Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability): r2 - [CVE-2025-21418](https://www.precursorintelligence.com/what-is/cve-2025-21418) (Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability): r2 - [CVE-2024-35250](https://www.precursorintelligence.com/what-is/cve-2024-35250) (Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability): r2 - [CVE-2024-49138](https://www.precursorintelligence.com/what-is/cve-2024-49138) (Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability): r2 - [CVE-2024-43451](https://www.precursorintelligence.com/what-is/cve-2024-43451) (Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability): r2 - [CVE-2024-43573](https://www.precursorintelligence.com/what-is/cve-2024-43573) (Microsoft Windows MSHTML Platform Spoofing Vulnerability): r2 1 more exploited flaw names Windows Server 2012 without a version of its own (for example as the system other affected software runs on). They are in the list below. Checked: the 30 most recently added of 50 exploited flaws. ## Which Windows Server 2012 vulnerabilities are being exploited? 50 flaws are on the government list of vulnerabilities known to be exploited, newest first: - [CVE-2026-85880](https://www.precursorintelligence.com/what-is/cve-2026-85880): Microsoft Windows Heap-Based Buffer Overflow Vulnerability. High, CVSS 7.8, chance of use in 30 days 3.6%, known exploited since 8 September 2026. - [CVE-2026-56155](https://www.precursorintelligence.com/what-is/cve-2026-56155): Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability. High, CVSS 7.8, chance of use in 30 days 0.3%, known exploited since 14 July 2026. - [CVE-2023-36424](https://www.precursorintelligence.com/what-is/cve-2023-36424): Microsoft Windows Out-of-Bounds Read Vulnerability. High, CVSS 7.8, chance of use in 30 days 12%, known exploited since 13 April 2026. - [CVE-2025-59287](https://www.precursorintelligence.com/what-is/cve-2025-59287): Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data Vulnerability. Critical, CVSS 9.8, chance of use in 30 days >99%, known exploited since 24 October 2025. - [CVE-2025-33073](https://www.precursorintelligence.com/what-is/cve-2025-33073): Microsoft Windows SMB Client Improper Access Control Vulnerability. High, CVSS 8.8, chance of use in 30 days 83%, known exploited since 20 October 2025. - [CVE-2025-47827](https://www.precursorintelligence.com/what-is/cve-2025-47827): IGEL OS Use of a Key Past its Expiration Date Vulnerability. Medium, CVSS 4.6, chance of use in 30 days 4.9%, known exploited since 14 October 2025. - [CVE-2025-24990](https://www.precursorintelligence.com/what-is/cve-2025-24990): Microsoft Windows Untrusted Pointer Dereference Vulnerability. High, CVSS 7.8, chance of use in 30 days 6.4%, known exploited since 14 October 2025. - [CVE-2025-59230](https://www.precursorintelligence.com/what-is/cve-2025-59230): Microsoft Windows Improper Access Control Vulnerability. High, CVSS 7.8, chance of use in 30 days 2.7%, known exploited since 14 October 2025. - [CVE-2013-3918](https://www.precursorintelligence.com/what-is/cve-2013-3918): Microsoft Windows Out-of-Bounds Write Vulnerability. High, CVSS 8.8, chance of use in 30 days 74%, known exploited since 6 October 2025. - [CVE-2021-43226](https://www.precursorintelligence.com/what-is/cve-2021-43226): Microsoft Windows Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 3.3%, known exploited since 6 October 2025. - [CVE-2025-33053](https://www.precursorintelligence.com/what-is/cve-2025-33053): Microsoft Windows External Control of File Name or Path Vulnerability. High, CVSS 8.8, chance of use in 30 days 87%, known exploited since 10 June 2025. - [CVE-2025-30397](https://www.precursorintelligence.com/what-is/cve-2025-30397): Microsoft Windows Scripting Engine Type Confusion Vulnerability. High, CVSS 7.5, chance of use in 30 days 27%, known exploited since 13 May 2025. - [CVE-2025-32701](https://www.precursorintelligence.com/what-is/cve-2025-32701): Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability. High, CVSS 7.8, chance of use in 30 days 1.4%, known exploited since 13 May 2025. - [CVE-2025-32706](https://www.precursorintelligence.com/what-is/cve-2025-32706): Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability. High, CVSS 7.8, chance of use in 30 days 2.3%, known exploited since 13 May 2025. - [CVE-2025-32709](https://www.precursorintelligence.com/what-is/cve-2025-32709): Microsoft Windows Ancillary Function Driver for WinSock Use-After-Free Vulnerability. High, CVSS 7.8, chance of use in 30 days 1.8%, known exploited since 13 May 2025. - [CVE-2025-24054](https://www.precursorintelligence.com/what-is/cve-2025-24054): Microsoft Windows NTLM Hash Disclosure Spoofing Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 62%, known exploited since 17 April 2025. - [CVE-2025-29824](https://www.precursorintelligence.com/what-is/cve-2025-29824): Microsoft Windows Common Log File System (CLFS) Driver Use-After-Free Vulnerability. High, CVSS 7.8, chance of use in 30 days 14%, known exploited since 8 April 2025. - [CVE-2025-24984](https://www.precursorintelligence.com/what-is/cve-2025-24984): Microsoft Windows NTFS Information Disclosure Vulnerability. Medium, CVSS 4.6, chance of use in 30 days 2.0%, known exploited since 11 March 2025. - [CVE-2025-26633](https://www.precursorintelligence.com/what-is/cve-2025-26633): Microsoft Windows Management Console (MMC) Improper Neutralization Vulnerability. High, CVSS 7.0, chance of use in 30 days 30%, known exploited since 11 March 2025. - [CVE-2025-24993](https://www.precursorintelligence.com/what-is/cve-2025-24993): Microsoft Windows NTFS Heap-Based Buffer Overflow Vulnerability. High, CVSS 7.8, chance of use in 30 days 2.2%, known exploited since 11 March 2025. - [CVE-2025-24985](https://www.precursorintelligence.com/what-is/cve-2025-24985): Microsoft Windows Fast FAT File System Driver Integer Overflow Vulnerability. High, CVSS 7.8, chance of use in 30 days 3.9%, known exploited since 11 March 2025. - [CVE-2025-24983](https://www.precursorintelligence.com/what-is/cve-2025-24983): Microsoft Windows Win32k Use-After-Free Vulnerability. High, CVSS 7.0, chance of use in 30 days 1.4%, known exploited since 11 March 2025. - [CVE-2025-24991](https://www.precursorintelligence.com/what-is/cve-2025-24991): Microsoft Windows NTFS Out-Of-Bounds Read Vulnerability. Medium, CVSS 5.5, chance of use in 30 days 2.0%, known exploited since 11 March 2025. - [CVE-2018-8639](https://www.precursorintelligence.com/what-is/cve-2018-8639): Microsoft Windows Win32k Improper Resource Shutdown or Release Vulnerability. High, CVSS 7.8, chance of use in 30 days 22%, known exploited since 3 March 2025. - [CVE-2025-21418](https://www.precursorintelligence.com/what-is/cve-2025-21418): Microsoft Windows Ancillary Function Driver for WinSock Heap-Based Buffer Overflow Vulnerability. High, CVSS 7.8, chance of use in 30 days 1.6%, known exploited since 11 February 2025. - [CVE-2024-29059](https://www.precursorintelligence.com/what-is/cve-2024-29059): Microsoft .NET Framework Information Disclosure Vulnerability. High, CVSS 7.5, chance of use in 30 days 99%, known exploited since 4 February 2025. - [CVE-2024-35250](https://www.precursorintelligence.com/what-is/cve-2024-35250): Microsoft Windows Kernel-Mode Driver Untrusted Pointer Dereference Vulnerability. High, CVSS 7.8, chance of use in 30 days 25%, known exploited since 16 December 2024. - [CVE-2024-49138](https://www.precursorintelligence.com/what-is/cve-2024-49138): Microsoft Windows Common Log File System (CLFS) Driver Heap-Based Buffer Overflow Vulnerability. High, CVSS 7.8, chance of use in 30 days 26%, known exploited since 10 December 2024. - [CVE-2024-43451](https://www.precursorintelligence.com/what-is/cve-2024-43451): Microsoft Windows NTLMv2 Hash Disclosure Spoofing Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 85%, known exploited since 12 November 2024. - [CVE-2024-43573](https://www.precursorintelligence.com/what-is/cve-2024-43573): Microsoft Windows MSHTML Platform Spoofing Vulnerability. High, CVSS 8.1, chance of use in 30 days 46%, known exploited since 8 October 2024. - [CVE-2024-43572](https://www.precursorintelligence.com/what-is/cve-2024-43572): Microsoft Windows Management Console Remote Code Execution Vulnerability. High, CVSS 7.8, chance of use in 30 days 67%, known exploited since 8 October 2024. - [CVE-2024-43461](https://www.precursorintelligence.com/what-is/cve-2024-43461): Microsoft Windows MSHTML Platform Spoofing Vulnerability. High, CVSS 8.8, chance of use in 30 days 54%, known exploited since 16 September 2024. - [CVE-2024-38014](https://www.precursorintelligence.com/what-is/cve-2024-38014): Microsoft Windows Installer Improper Privilege Management Vulnerability. High, CVSS 7.8, chance of use in 30 days 6.3%, known exploited since 10 September 2024. - [CVE-2024-38217](https://www.precursorintelligence.com/what-is/cve-2024-38217): Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability. Medium, CVSS 5.4, chance of use in 30 days 10%, known exploited since 10 September 2024. - [CVE-2024-38213](https://www.precursorintelligence.com/what-is/cve-2024-38213): Microsoft Windows SmartScreen Security Feature Bypass Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 14%, known exploited since 13 August 2024. - [CVE-2024-38178](https://www.precursorintelligence.com/what-is/cve-2024-38178): Microsoft Windows Scripting Engine Memory Corruption Vulnerability. High, CVSS 7.5, chance of use in 30 days 41%, known exploited since 13 August 2024. - [CVE-2024-38193](https://www.precursorintelligence.com/what-is/cve-2024-38193): Microsoft Windows Ancillary Function Driver for WinSock Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 29%, known exploited since 13 August 2024. - [CVE-2024-38107](https://www.precursorintelligence.com/what-is/cve-2024-38107): Microsoft Windows Power Dependency Coordinator Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 1.6%, known exploited since 13 August 2024. - [CVE-2018-0824](https://www.precursorintelligence.com/what-is/cve-2018-0824): Microsoft COM for Windows Deserialization of Untrusted Data Vulnerability. High, CVSS 8.8, chance of use in 30 days 73%, known exploited since 5 August 2024. - [CVE-2024-38112](https://www.precursorintelligence.com/what-is/cve-2024-38112): Microsoft Windows MSHTML Platform Spoofing Vulnerability. High, CVSS 7.5, chance of use in 30 days 84%, known exploited since 9 July 2024. - [CVE-2024-26169](https://www.precursorintelligence.com/what-is/cve-2024-26169): Microsoft Windows Error Reporting Service Improper Privilege Management Vulnerability. High, CVSS 7.8, chance of use in 30 days 4.0%, known exploited since 13 June 2024. - [CVE-2022-38028](https://www.precursorintelligence.com/what-is/cve-2022-38028): Microsoft Windows Print Spooler Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 15%, known exploited since 23 April 2024. - [CVE-2023-36584](https://www.precursorintelligence.com/what-is/cve-2023-36584): Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability. Medium, CVSS 5.4, chance of use in 30 days 3.3%, known exploited since 16 November 2023. - [CVE-2023-36025](https://www.precursorintelligence.com/what-is/cve-2023-36025): Microsoft Windows SmartScreen Security Feature Bypass Vulnerability. High, CVSS 8.8, chance of use in 30 days 88%, known exploited since 14 November 2023. - [CVE-2023-36036](https://www.precursorintelligence.com/what-is/cve-2023-36036): Microsoft Windows Cloud Files Mini Filter Driver Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 17%, known exploited since 14 November 2023. - [CVE-2023-36563](https://www.precursorintelligence.com/what-is/cve-2023-36563): Microsoft WordPad Information Disclosure Vulnerability. Medium, CVSS 6.5, chance of use in 30 days 20%, known exploited since 10 October 2023. - [CVE-2023-28229](https://www.precursorintelligence.com/what-is/cve-2023-28229): Microsoft Windows CNG Key Isolation Service Privilege Escalation Vulnerability. High, CVSS 7.0, chance of use in 30 days 1.7%, known exploited since 4 October 2023. - [CVE-2023-36884](https://www.precursorintelligence.com/what-is/cve-2023-36884): Microsoft Windows Search Remote Code Execution Vulnerability. High, CVSS 7.5, chance of use in 30 days 99%, known exploited since 17 July 2023. - [CVE-2023-32046](https://www.precursorintelligence.com/what-is/cve-2023-32046): Microsoft Windows MSHTML Platform Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 10%, known exploited since 11 July 2023. - [CVE-2023-36874](https://www.precursorintelligence.com/what-is/cve-2023-36874): Microsoft Windows Error Reporting Service Privilege Escalation Vulnerability. High, CVSS 7.8, chance of use in 30 days 43%, known exploited since 11 July 2023. ## Which Windows Server 2012 flaws are most likely to be used? Ranked by the latest exploit-likelihood forecast (the chance each flaw is used in an attack in the next 30 days): - [CVE-2015-1635](https://www.precursorintelligence.com/what-is/cve-2015-1635): >99%, Critical (CVSS 9.8), known exploited - [CVE-2013-2251](https://www.precursorintelligence.com/what-is/cve-2013-2251): >99%, Critical (CVSS 9.8), known exploited - [CVE-2017-0147](https://www.precursorintelligence.com/what-is/cve-2017-0147): >99%, High (CVSS 7.5), known exploited - [CVE-2017-0199](https://www.precursorintelligence.com/what-is/cve-2017-0199): >99%, High (CVSS 7.8), known exploited - [CVE-2017-0148](https://www.precursorintelligence.com/what-is/cve-2017-0148): >99%, High (CVSS 8.1), known exploited - [CVE-2017-0144](https://www.precursorintelligence.com/what-is/cve-2017-0144): >99%, High (CVSS 8.8), known exploited - [CVE-2015-0014](https://www.precursorintelligence.com/what-is/cve-2015-0014): 97%, Critical (CVSS 10.0) - [CVE-2014-6321](https://www.precursorintelligence.com/what-is/cve-2014-6321): 96%, Critical (CVSS 10.0) - [CVE-2015-0313](https://www.precursorintelligence.com/what-is/cve-2015-0313): 95%, Critical (CVSS 9.8), known exploited - [CVE-2014-6332](https://www.precursorintelligence.com/what-is/cve-2014-6332): 95%, High (CVSS 8.8), known exploited ## Questions ### How many vulnerabilities does Windows Server 2012 have? We track 3,842 published vulnerabilities listed under the name Windows Server 2012, across 7 versions. The most recent Windows Server 2012 flaw added to the known-exploited list is CVE-2026-85880, on 8 September 2026. ### Which Windows Server 2012 vulnerabilities are being exploited? 198 are on the list of flaws known to be exploited. The most recently added are CVE-2026-85880, CVE-2026-56155 and CVE-2023-36424. ### Which versions of Windows Server 2012 do the exploited flaws affect? Each flaw names its own versions, usually as ranges. The newest, CVE-2026-85880, affects r2. The versions for every exploited flaw are listed on this page. ### How do I get alerts for Windows Server 2012? Create a Precursor Intelligence account and track Windows Server 2012. We match it against every published flaw, give each one a risk score from 0 to 100 and keep watching, so you hear about new ones as soon as we know, by email, in the app or by webhook. ## Running Windows Server 2012? Precursor Intelligence keeps checking for you: - **Tell us what you run.** Pick your software from a list, or let us work it out from your website. - **We match it to every flaw.** Over 400,000 published flaws, checked against your list. - **Ranked by real-world risk.** Every flaw gets a 0 to 100 risk score, kept up to date, led by evidence criminals are using it. - **Told as soon as we know.** An alert by email, in the app or by webhook to your own tools. Start free (no card, nothing to install): https://www.precursorintelligence.com/register Book a demo: https://www.precursorintelligence.com/contact