Class familyMicrosoft · Windows
Microsoft Windows access control flaws, 2016–2026
65 Windows CVEs with CWE-284 weaknesses, 14 Oct 2016 to 8 Sep 2026. 5 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
2 2016’16
2017’17
2018’18
2019’19
2020’20
2021’21
2022’22
2023’23
2024’24
25 2025’25
38 2026’26
In CISA KEVNot in KEV
20162 CVEs, 2 in KEV
202525 CVEs, 2 in KEV
- CVE-2025-24076
- CVE-2025-24994
- CVE-2025-27738
- CVE-2025-29810
- CVE-2025-32714
- CVE-2025-32722
- CVE-2025-33073
- CVE-2025-47962
- CVE-2025-47993
- CVE-2025-54098
- CVE-2025-54116
- CVE-2025-55694
- CVE-2025-58714
- CVE-2025-58726
- CVE-2025-59199
- CVE-2025-59201
- CVE-2025-59230
- CVE-2025-59253
- CVE-2025-59512
- CVE-2025-60705
- CVE-2025-59517
- CVE-2025-62474
- CVE-2025-62570
- CVE-2025-64673
- CVE-2025-64669
202638 CVEs, 1 in KEV
- CVE-2026-20825
- CVE-2026-20839
- CVE-2026-20843
- CVE-2026-20929
- CVE-2026-21238
- CVE-2026-21255
- CVE-2026-23660
- CVE-2026-24290
- CVE-2026-25176
- CVE-2026-26183
- CVE-2026-27914
- CVE-2026-32220
- CVE-2026-32209
- CVE-2026-33834
- CVE-2026-41086
- CVE-2026-41092
- CVE-2026-42829
- CVE-2026-45654
- CVE-2026-45658
- CVE-2026-48578
- CVE-2026-49805
- CVE-2026-50297
- CVE-2026-50311
- CVE-2026-50325
- CVE-2026-50335
- CVE-2026-50342
- CVE-2026-50351
- CVE-2026-50373
- CVE-2026-50418
- CVE-2026-50423
- CVE-2026-50465
- CVE-2026-50495
- CVE-2026-55014
- CVE-2026-57088
- CVE-2026-58545
- CVE-2026-65773
- CVE-2026-66804
- CVE-2026-81963
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2016-3393KEV | 14 Oct 2016 | Microsoft Windows Graphics Device Interface (GDI) Remote Code Execution Vulnerability | Grouped by weakness | 63.3 |
| CVE-2016-7256KEV | 10 Nov 2016 | Microsoft Windows Open Type Font Remote Code Execution Vulnerability | Grouped by weakness | 64.0 |
| CVE-2025-24076 | 11 Mar 2025 | Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability | Grouped by weakness | 27.7 |
| CVE-2025-24994 | 11 Mar 2025 | Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability | Grouped by weakness | 18.7 |
| CVE-2025-27738 | 8 Apr 2025 | Windows Resilient File System (ReFS) Information Disclosure Vulnerability | Grouped by weakness | 22.4 |
| CVE-2025-29810 | 8 Apr 2025 | Active Directory Domain Services Elevation of Privilege Vulnerability | Grouped by weakness | 27.3 |
| CVE-2025-32714 | 10 Jun 2025 | Windows Installer Elevation of Privilege Vulnerability | Grouped by weakness | 19.7 |
| CVE-2025-32722 | 10 Jun 2025 | Windows Storage Port Driver Information Disclosure Vulnerability | Grouped by weakness | 16.8 |
| CVE-2025-33073KEV | 10 Jun 2025 | Microsoft Windows SMB Client Improper Access Control Vulnerability | Grouped by weakness | 79.1 |
| CVE-2025-47962 | 10 Jun 2025 | Windows SDK Elevation of Privilege Vulnerability | Grouped by weakness | 25.5 |
| CVE-2025-47993 | 8 Jul 2025 | Microsoft PC Manager Elevation of Privilege Vulnerability | Grouped by weakness | 12.5 |
| CVE-2025-54098 | 9 Sep 2025 | Windows Hyper-V Elevation of Privilege Vulnerability | Grouped by weakness | 23.2 |
| CVE-2025-54116 | 9 Sep 2025 | Windows MultiPoint Services Elevation of Privilege Vulnerability | Grouped by weakness | 14.1 |
| CVE-2025-55694 | 14 Oct 2025 | Windows Error Reporting Service Elevation of Privilege Vulnerability | Grouped by weakness | 23.0 |
| CVE-2025-58714 | 14 Oct 2025 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Grouped by weakness | 9.4 |
| CVE-2025-58726 | 14 Oct 2025 | Windows SMB Server Elevation of Privilege Vulnerability | Grouped by weakness | 22.9 |
| CVE-2025-59199 | 14 Oct 2025 | Software Protection Platform (SPP) Elevation of Privilege Vulnerability | Grouped by weakness | 23.7 |
| CVE-2025-59201 | 14 Oct 2025 | Network Connection Status Indicator (NCSI) Elevation of Privilege Vulnerability | Grouped by weakness | 13.3 |
| CVE-2025-59230KEV | 14 Oct 2025 | Microsoft Windows Improper Access Control Vulnerability | Grouped by weakness | 60.6 |
| CVE-2025-59253 | 14 Oct 2025 | Windows Search Service Denial of Service Vulnerability | Grouped by weakness | 9.3 |
| CVE-2025-59512 | 11 Nov 2025 | Customer Experience Improvement Program (CEIP) Elevation of Privilege Vulnerability | Grouped by weakness | 23.0 |
| CVE-2025-60705 | 11 Nov 2025 | Windows Client-Side Caching Elevation of Privilege Vulnerability | Grouped by weakness | 22.5 |
| CVE-2025-59517 | 9 Dec 2025 | Windows Storage VSP Driver Elevation of Privilege Vulnerability | Grouped by weakness | 22.3 |
| CVE-2025-62474 | 9 Dec 2025 | Windows Remote Access Connection Manager Elevation of Privilege Vulnerability | Grouped by weakness | 11.6 |
| CVE-2025-62570 | 9 Dec 2025 | Windows Camera Frame Server Monitor Information Disclosure Vulnerability | Grouped by weakness | 11.9 |
| CVE-2025-64673 | 9 Dec 2025 | Windows Storage VSP Driver Elevation of Privilege Vulnerability | Grouped by weakness | 11.6 |
| CVE-2025-64669 | 11 Dec 2025 | Windows Admin Center Elevation of Privilege Vulnerability | Grouped by weakness | 13.6 |
| CVE-2026-20825 | 13 Jan 2026 | Windows Hyper-V Information Disclosure Vulnerability | Grouped by weakness | 12.1 |
| CVE-2026-20839 | 13 Jan 2026 | Windows Client-Side Caching (CSC) Service Information Disclosure Vulnerability | Grouped by weakness | 12.1 |
| CVE-2026-20843 | 13 Jan 2026 | Windows Routing and Remote Access Service (RRAS) Elevation of Privilege Vulnerability | Grouped by weakness | 23.2 |
| CVE-2026-20929 | 13 Jan 2026 | Windows HTTP.sys Elevation of Privilege Vulnerability | Grouped by weakness | 27.6 |
| CVE-2026-21238 | 10 Feb 2026 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Grouped by weakness | 23.2 |
| CVE-2026-21255 | 10 Feb 2026 | Windows Hyper-V Security Feature Bypass Vulnerability | Grouped by weakness | 12.6 |
| CVE-2026-23660 | 10 Mar 2026 | Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability | Grouped by weakness | 10.5 |
| CVE-2026-24290 | 10 Mar 2026 | Windows Projected File System Elevation of Privilege Vulnerability | Grouped by weakness | 11.2 |
| CVE-2026-25176 | 10 Mar 2026 | Windows Ancillary Function Driver for WinSock Elevation of Privilege Vulnerability | Grouped by weakness | 12.2 |
| CVE-2026-26183 | 14 Apr 2026 | Remote Access Management service/API (RPC server) Elevation of Privilege Vulnerability | Grouped by weakness | 8.9 |
| CVE-2026-27914 | 14 Apr 2026 | Microsoft Management Console Elevation of Privilege Vulnerability | Grouped by weakness | 22.3 |
| CVE-2026-32220 | 14 Apr 2026 | UEFI Secure Boot Security Feature Bypass Vulnerability | Grouped by weakness | 7.3 |
| CVE-2026-32209 | 12 May 2026 | Windows Filtering Platform (WFP) Security Feature Bypass Vulnerability | Grouped by weakness | 5.2 |
| CVE-2026-33834 | 12 May 2026 | Windows Event Logging Service Elevation of Privilege Vulnerability | Grouped by weakness | 9.4 |
| CVE-2026-41086 | 12 May 2026 | Windows Admin Center in Azure Portal Elevation of Privilege Vulnerability | Grouped by weakness | 13.6 |
| CVE-2026-41092 | 9 Jun 2026 | Microsoft Kinect Elevation of Privilege Vulnerability | Grouped by weakness | 10.1 |
| CVE-2026-42829 | 9 Jun 2026 | Windows Administrator Protection Secure Feature Bypass Vulnerability | Grouped by weakness | 9.8 |
| CVE-2026-45654 | 9 Jun 2026 | Secure Boot Security Feature Bypass Vulnerability | Grouped by weakness | 10.3 |
| CVE-2026-45658 | 9 Jun 2026 | Windows BitLocker Security Feature Bypass Vulnerability | Grouped by weakness | 11.2 |
| CVE-2026-48578 | 9 Jun 2026 | Secure Boot Security Feature Bypass Vulnerability | Grouped by weakness | 9.3 |
| CVE-2026-49805 | 14 Jul 2026 | Win32k Elevation of Privilege Vulnerability | Grouped by weakness | 7.8 |
| CVE-2026-50297 | 14 Jul 2026 | Win32k Elevation of Privilege Vulnerability | Grouped by weakness | 7.8 |
| CVE-2026-50311 | 14 Jul 2026 | Windows Server Elevation of Privilege Vulnerability | Grouped by weakness | 10.0 |
| CVE-2026-50325 | 14 Jul 2026 | Win32k Elevation of Privilege Vulnerability | Grouped by weakness | 7.8 |
| CVE-2026-50335 | 14 Jul 2026 | Windows Operating Systems Elevation of Privilege Vulnerability | Grouped by weakness | 10.0 |
| CVE-2026-50342 | 14 Jul 2026 | Windows MIDI Service Module Elevation of Privileges Vulnerability | Grouped by weakness | 10.7 |
| CVE-2026-50351 | 14 Jul 2026 | Windows Audio Compression Manager (ACM) Elevation of Privilege Vulnerability | Grouped by weakness | 10.0 |
| CVE-2026-50373 | 14 Jul 2026 | Windows Search Service Elevation of Privilege Vulnerability | Grouped by weakness | 10.0 |
| CVE-2026-50418 | 14 Jul 2026 | Windows System Secure Feature Bypass Vulnerability | Grouped by weakness | 7.3 |
| CVE-2026-50423 | 14 Jul 2026 | Windows Kernel Elevation of Privilege Vulnerability | Grouped by weakness | 10.0 |
| CVE-2026-50465 | 14 Jul 2026 | Windows DNS Client Tampering Vulnerability | Grouped by weakness | 9.5 |
| CVE-2026-50495 | 14 Jul 2026 | DNS Client Tampering Vulnerability | Grouped by weakness | 8.9 |
| CVE-2026-55014 | 14 Jul 2026 | Windows Remote Help Defense Elevation of Privilege Vulnerability | Grouped by weakness | 10.0 |
| CVE-2026-57088 | 14 Jul 2026 | Extensible Storage Engine (ESENT) Elevation of Privilege Vulnerability | Grouped by weakness | 10.0 |
| CVE-2026-58545 | 14 Jul 2026 | Windows Kernel Security Feature Bypass Vulnerability | Grouped by weakness | 9.6 |
| CVE-2026-65773 | 11 Aug 2026 | Windows Kernel Elevation of Privilege Vulnerability | Grouped by weakness | 10.0 |
| CVE-2026-66804 | 11 Aug 2026 | Microsoft Windows Cross Device Service Elevation of Privilege Vulnerability | Grouped by weakness | 15.0 |
| CVE-2026-81963KEV | 8 Sep 2026 | Microsoft Windows Link Following Vulnerability | Grouped by weakness | 65.2 |