Windows Server 2008

Vendor:

First CVE: Jun 6, 2007 · Active for 19 years

4,079
Total CVEs
More Total CVEs than 100% of tracked products
203.9
Avg CVEs / Year
Higher CVE frequency than 100% of tracked products
7.4
Avg CVSS
Higher Avg CVSS than 48% of tracked products
4.9%
KEV Rate
Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Windows Server 2008 over time

Volume of CVEsAvg CVSS Base Score
First CVE
Jun 6, 2007
19 years ago
Most Recent CVE
Jan 13, 2026
192 days ago

CVE Severity & Scoring

Windows Server 20084,079 CVEs
All CVEs352,294 CVEs
LowMediumHighCritical
Attack Vector
Local1,664 (40.8%)
Network1,570 (38.5%)
Unknown728 (17.8%)
Physical47 (1.2%)
Adjacent Network70 (1.7%)
Attack Complexity
Low2,655 (65.1%)
High696 (17.1%)
Unknown728 (17.8%)
User Interaction
None2,114 (51.8%)
Unknown728 (17.8%)
Required1,237 (30.3%)
Privileges Required
Low1,611 (39.5%)
High99 (2.4%)
None1,641 (40.2%)
Unknown728 (17.8%)

Top CVEs

Signals from CVEs in this product scope (4079 CVEs).

4,079 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2020-1472CRITICAL
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protoc
Aug 17, 202010.099YESYES
CVE-2020-0646CRITICAL
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
Jan 14, 20209.899YESYES
CVE-2019-0708CRITICAL
A remote code execution vulnerability exists in Remote Desktop Services formerly known as Terminal Services when an unauthenticated attacker connects to the target system using RDP
May 16, 20199.899YESYES
CVE-2015-1635CRITICAL
HTTP.sys in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8, Windows 8.1, and Windows Server 2012 Gold and R2 allows remote attackers to execute arbitrary code via c
Apr 14, 20159.899YESYES
CVE-2013-2251CRITICAL
Apache Struts 2.0.0 through 2.3.15 allows remote attackers to execute arbitrary OGNL expressions via a parameter with a crafted (1) action:, (2) redirect:, or (3) redirectAction: p
Jul 20, 20139.899YESYES
CVE-2020-1147HIGH
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.
Jul 14, 20207.898YESYES
CVE-2017-8464HIGH
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607,
Jun 15, 20178.898YESYES
CVE-2017-0199HIGH
Microsoft Office 2007 SP3, Microsoft Office 2010 SP2, Microsoft Office 2013 SP1, Microsoft Office 2016, Microsoft Windows Vista SP2, Windows Server 2008 SP2, Windows 7 SP1, Windows
Apr 12, 20177.898YESYES
CVE-2017-0148HIGH
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gol
Mar 17, 20178.198YESYES
CVE-2017-0147HIGH
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gol
Mar 17, 20177.598YESYES
View all 4,079 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (4079 CVEs).

CISA KEV
200 CVEs
4.9% of CVEs· 97th percentile
Metasploit
109 CVEs
2.7% of CVEs· 96th percentile
Nuclei
4 CVEs
0.1% of CVEs· 96th percentile
ExploitDB
439 CVEs
10.8% of CVEs· 89th percentile

Social Chatter

Signals from CVEs in this product scope (4079 CVEs).

Media Mentions

Signals from CVEs in this product scope (4079 CVEs).

Top CNAs Publishing CVEs For Windows Server 2008

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
sp2667.811.2%45
r23,1667.38.8%141325