Windows Server 2016

Vendor:

First CVE: Dec 11, 2013 · Active for 12 years

5,513
Total CVEs
More Total CVEs than 100% of tracked products
459.4
Avg CVEs / Year
Higher CVE frequency than 100% of tracked products
7.3
Avg CVSS
Higher Avg CVSS than 46% of tracked products
3.3%
KEV Rate
Higher KEV Rate than 97% of tracked products

Trends Over Time

The number and severity of CVEs published that impact Windows Server 2016 over time

Volume of CVEsAvg CVSS Base Score
First CVE
Dec 11, 2013
12 years ago
Most Recent CVE
Jul 14, 2026
10 days ago

CVE Severity & Scoring

Windows Server 20165,513 CVEs
All CVEs352,231 CVEs
LowMediumHighCritical
Attack Vector
Local3,034 (55.0%)
Network2,211 (40.1%)
Unknown0 (0.0%)
Physical103 (1.9%)
Adjacent Network165 (3.0%)
Attack Complexity
Low4,299 (78.0%)
High1,214 (22.0%)
Unknown0 (0.0%)
User Interaction
None3,883 (70.4%)
Unknown0 (0.0%)
Required1,630 (29.6%)
Privileges Required
Low2,999 (54.4%)
High227 (4.1%)
None2,287 (41.5%)
Unknown0 (0.0%)

Top CVEs

Signals from CVEs in this product scope (5513 CVEs).

5,513 CVEs · Highest risk first

CVEPublishedCVSSRiskKEVExploit
CVE-2025-59287CRITICAL
Deserialization of untrusted data in Windows Server Update Service allows an unauthorized attacker to execute code over a network.
Oct 14, 20259.899YESYES
CVE-2020-1472CRITICAL
An elevation of privilege vulnerability exists when an attacker establishes a vulnerable Netlogon secure channel connection to a domain controller, using the Netlogon Remote Protoc
Aug 17, 202010.099YESYES
CVE-2020-0646CRITICAL
A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka '.NET Framework Remote Code Execution Injection Vulnerability'.
Jan 14, 20209.899YESYES
CVE-2020-1147HIGH
A remote code execution vulnerability exists in .NET Framework, Microsoft SharePoint, and Visual Studio when the software fails to check the source markup of XML file input, aka '.
Jul 14, 20207.898YESYES
CVE-2017-8464HIGH
Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607,
Jun 15, 20178.898YESYES
CVE-2017-0148HIGH
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gol
Mar 17, 20178.198YESYES
CVE-2017-0147HIGH
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gol
Mar 17, 20177.598YESYES
CVE-2017-0144HIGH
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gol
Mar 17, 20178.898YESYES
CVE-2017-0143HIGH
The SMBv1 server in Microsoft Windows Vista SP2; Windows Server 2008 SP2 and R2 SP1; Windows 7 SP1; Windows 8.1; Windows Server 2012 Gold and R2; Windows RT 8.1; and Windows 10 Gol
Mar 17, 20178.898YESYES
CVE-2024-29059HIGH
.NET Framework Information Disclosure Vulnerability
Mar 23, 20247.597YESYES
View all 5,513 CVEs →

Exploit Exposure

Signals from CVEs in this product scope (5513 CVEs).

CISA KEV
184 CVEs
3.3% of CVEs· 97th percentile
Metasploit
40 CVEs
0.7% of CVEs· 96th percentile
Nuclei
3 CVEs
0.1% of CVEs· 96th percentile
ExploitDB
293 CVEs
5.3% of CVEs· 88th percentile

Social Chatter

Signals from CVEs in this product scope (5513 CVEs).

Media Mentions

Signals from CVEs in this product scope (5513 CVEs).

Top CNAs Publishing CVEs For Windows Server 2016

Top CWEs

Versions

VersionCVE CountAvg CVSSAvg EPSSKEVExploits
20h26687.52.9%11
201918.82.5%00
20048967.53.0%23
19099547.53.3%16
19031,0017.44.4%138
18038847.36.4%264
17093046.98.3%045