Threat Entry Updated 2026-01-16

CVE-2026-20940 - Windows Server 2008 Service Pack 2 Plugin

Heap-based buffer overflow in Windows Cloud Files Mini Filter Driver allows an authorized attacker to elevate privileges locally.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20940

HIGH CVSS 7.8 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-16

CVE-2026-20931 - Windows Server 2008 Service Pack 2 Plugin

External control of file name or path in Windows Telephony Service allows an authorized attacker to elevate privileges over an adjacent network.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20931

HIGH CVSS 8.0 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-16

CVE-2026-20936 - Windows Server 2008 Service Pack 2 Plugin

Out-of-bounds read in Windows NDIS allows an authorized attacker to disclose information with a physical attack.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20936

MEDIUM CVSS 4.3 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-16

CVE-2026-20929 - Windows Server 2008 Service Pack 2 Plugin

Improper access control in Windows HTTP.sys allows an authorized attacker to elevate privileges over a network.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20929

HIGH CVSS 7.5 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-16

CVE-2026-20925 - Windows Server 2008 Service Pack 2 Plugin

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20925

MEDIUM CVSS 6.5 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-16

CVE-2026-20927 - Windows Server 2008 Service Pack 2 Plugin

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to deny service over a network.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20927

MEDIUM CVSS 5.3 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20922 - Windows Server 2008 Service Pack 2 Plugin

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20922

HIGH CVSS 7.8 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20921 - Windows Server 2008 Service Pack 2 Plugin

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows SMB Server allows an authorized attacker to elevate privileges over a network.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20921

HIGH CVSS 7.5 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20875 - Windows Server 2008 Service Pack 2 Plugin

Null pointer dereference in Windows Local Security Authority Subsystem Service (LSASS) allows an unauthorized attacker to deny service over a network.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20875

HIGH CVSS 7.5 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-02-10

CVE-2026-20868 - Windows Server 2008 Service Pack 2 Plugin

Heap-based buffer overflow in Windows Routing and Remote Access Service (RRAS) allows an unauthorized attacker to execute code over a network.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20868

HIGH CVSS 8.8 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20869 - Windows Server 2008 Service Pack 2 Plugin

Concurrent execution using shared resource with improper synchronization ('race condition') in Windows Local Session Manager (LSM) allows an authorized attacker to elevate privileges locally.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20869

HIGH CVSS 7.0 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20872 - Windows Server 2008 Service Pack 2 Plugin

External control of file name or path in Windows NTLM allows an unauthorized attacker to perform spoofing over a network.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20872

MEDIUM CVSS 6.5 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20860 - Windows Server 2008 Service Pack 2 Plugin

Access of resource using incompatible type ('type confusion') in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20860

HIGH CVSS 7.8 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20849 - Windows Server 2008 Service Pack 2 Plugin

Reliance on untrusted inputs in a security decision in Windows Kerberos allows an authorized attacker to elevate privileges over a network.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20849

HIGH CVSS 7.5 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20843 - Windows Server 2008 Service Pack 2 Plugin

Improper access control in Windows Routing and Remote Access Service (RRAS) allows an authorized attacker to elevate privileges locally.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20843

HIGH CVSS 7.8 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20840 - Windows Server 2008 Service Pack 2 Plugin

Heap-based buffer overflow in Windows NTFS allows an authorized attacker to execute code locally.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20840

HIGH CVSS 7.8 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20833 - Windows Server 2008 Service Pack 2 Plugin

Use of a broken or risky cryptographic algorithm in Windows Kerberos allows an authorized attacker to disclose information locally.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20833

MEDIUM CVSS 5.5 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20834 - Windows Server 2008 Service Pack 2 Plugin

Absolute path traversal in Windows Shell allows an unauthorized attacker to perform spoofing with a physical attack.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20834

MEDIUM CVSS 4.6 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20831 - Windows Server 2008 Service Pack 2 Plugin

Time-of-check time-of-use (toctou) race condition in Windows Ancillary Function Driver for WinSock allows an authorized attacker to elevate privileges locally.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20831

HIGH CVSS 7.8 2026-01-13

Risk Score

Open Full Technical Breakdown

Threat Entry Updated 2026-01-15

CVE-2026-20828 - Windows Server 2008 Service Pack 2 Plugin

Out-of-bounds read in Windows Internet Connection Sharing (ICS) allows an unauthorized attacker to disclose information with a physical attack.

PLUGIN Windows Server 2008 Service Pack 2

CVE-2026-20828

MEDIUM CVSS 4.6 2026-01-13

Risk Score

Open Full Technical Breakdown