# Microsoft Windows Server 2025


- [CVE-2026-33824](https://insights.sbomify.com/CVE-2026-33824/): Microsoft Internet Key Exchange (IKE) Service Extensions Double Free (critical 9.8, exploited in the wild)
- [CVE-2025-59287](https://insights.sbomify.com/CVE-2025-59287/): Microsoft Windows Server Update Service (WSUS) Deserialization of Untrusted Data (critical 9.8, exploited in the wild)
- [CVE-2026-96951](https://insights.sbomify.com/CVE-2026-96951/): Microsoft Windows Command Injection (high 8.8, exploited in the wild)
- [CVE-2026-21510](https://insights.sbomify.com/CVE-2026-21510/): Microsoft Windows Shell Protection Mechanism Failure (high 8.8, exploited in the wild)
- [CVE-2026-21513](https://insights.sbomify.com/CVE-2026-21513/): Microsoft MSHTML Framework Protection Mechanism Failure (high 8.8, exploited in the wild)
- [CVE-2025-33053](https://insights.sbomify.com/CVE-2025-33053/): Microsoft Windows External Control of File Name or Path (high 8.8, exploited in the wild)
- [CVE-2025-33073](https://insights.sbomify.com/CVE-2025-33073/): Microsoft Windows SMB Client Improper Access Control (high 8.8, exploited in the wild)
- [CVE-2024-49039](https://insights.sbomify.com/CVE-2024-49039/): Microsoft Windows Task Scheduler Privilege Escalation (high 8.8, exploited in the wild)
- [CVE-2026-81963](https://insights.sbomify.com/CVE-2026-81963/): Microsoft Windows Link Following (high 7.8, exploited in the wild)
- [CVE-2026-56155](https://insights.sbomify.com/CVE-2026-56155/): Microsoft Active Directory Federation Services Insufficient Granularity of Access Control Vulnerability (high 7.8, exploited in the wild)
- [CVE-2026-21519](https://insights.sbomify.com/CVE-2026-21519/): Microsoft Windows Type Confusion (high 7.8, exploited in the wild)
- [CVE-2026-21533](https://insights.sbomify.com/CVE-2026-21533/): Microsoft Windows Improper Privilege Management (high 7.8, exploited in the wild)

---
From sbomify Insights: https://insights.sbomify.com/products/microsoft/windows-server-2025/