Exchange Server (Microsoft) - vulnerabilities (CVEs)

258 CVEs, 3 in the last 30 days, 192 known versions, newest CVE from 2026-10-13. Vendor: Microsoft.

CVEs of Exchange Server

• CVE-2026-87696 - CVSS 7.5 (high), 2026-10-13: Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-87695 - CVSS 7.8 (high), 2026-10-13: Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-96940 - CVSS 8.8 (high), 2026-10-02: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-69641 - CVSS 9.1 (critical), 2026-09-08: Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-69382 - CVSS 5.9 (medium), 2026-09-08: Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
• CVE-2026-69380 - CVSS 8.1 (high), 2026-09-08: Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-69378 - CVSS 7.5 (high), 2026-09-08: Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
• CVE-2026-69375 - CVSS 6.5 (medium), 2026-09-08: Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
• CVE-2026-69361 - CVSS 6.5 (medium), 2026-09-08: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
• CVE-2026-69356 - CVSS 9.3 (critical), 2026-09-08: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…
• CVE-2026-69355 - CVSS 8.8 (high), 2026-09-08: External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
• CVE-2026-55007 - CVSS 8.1 (high), 2026-09-08: Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-62911 - CVSS 8 (high), 2026-08-11: Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-65813 - CVSS 8.8 (high), 2026-08-11: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-62914 - CVSS 7.3 (high), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform…
• CVE-2026-62915 - CVSS 6.5 (medium), 2026-08-11: Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.
• CVE-2026-62913 - CVSS 8.8 (high), 2026-08-11: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
• CVE-2026-62912 - CVSS 6.5 (medium), 2026-08-11: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
• CVE-2026-62910 - CVSS 8.8 (high), 2026-08-11: Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-55009 - CVSS 7.8 (high), 2026-07-14: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-55006 - CVSS 7.8 (high), 2026-07-14: Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-55008 - CVSS 9.6 (critical), 2026-07-14: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…
• CVE-2026-55005 - CVSS 8.8 (high), 2026-07-14: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
• CVE-2026-47631 - CVSS 8.1 (high), 2026-06-09: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…
• CVE-2026-45502 - CVSS 5 (medium), 2026-06-09: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
• CVE-2026-45583 - CVSS 8.1 (high), 2026-06-09: Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-45504 - CVSS 8.8 (high), 2026-06-09: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-45503 - CVSS 8.1 (high), 2026-06-09: Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
• CVE-2026-45501 - CVSS 6.5 (medium), 2026-06-09: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
• CVE-2026-45500 - CVSS 6.1 (medium), 2026-06-09: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…
• CVE-2026-42897 - CVSS 8.1 (high), 2026-05-14: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…
• CVE-2026-21527 - CVSS 6.5 (medium), 2026-02-10: User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-64667 - CVSS 5.3 (medium), 2025-12-09: User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-64666 - CVSS 7.5 (high), 2025-12-09: Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2025-59249 - CVSS 8.8 (high), 2025-10-14: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2025-59248 - CVSS 7.5 (high), 2025-10-14: Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-53782 - CVSS 8.4 (high), 2025-10-14: Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.
• CVE-2025-33051 - CVSS 7.5 (high), 2025-08-12: Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
• CVE-2025-25005 - CVSS 6.5 (medium), 2025-08-12: Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
• CVE-2025-25007 - CVSS 5.3 (medium), 2025-08-12: Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-25006 - CVSS 5.3 (medium), 2025-08-12: Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-53786 - CVSS 8 (high), 2025-08-06: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these…
• CVE-2024-49040 - CVSS 7.5 (high), 2024-11-12: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2024-26198 - CVSS 8.8 (high), 2024-03-12: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2024-21410 - CVSS 9.8 (critical), 2024-02-13: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2023-36439 - CVSS 8 (high), 2023-11-14: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-36050 - CVSS 8 (high), 2023-11-14: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2023-36039 - CVSS 8 (high), 2023-11-14: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2023-36035 - CVSS 8 (high), 2023-11-14: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2023-36778 - CVSS 8 (high), 2023-10-10: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-36777 - CVSS 5.7 (medium), 2023-09-12: Microsoft Exchange Server Information Disclosure Vulnerability
• CVE-2023-36757 - CVSS 8 (high), 2023-09-12: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2023-36745 - CVSS 8 (high), 2023-09-12: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-36744 - CVSS 8 (high), 2023-09-12: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-36756 - CVSS 8 (high), 2023-09-12: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-38185 - CVSS 8.8 (high), 2023-08-08: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-38182 - CVSS 8 (high), 2023-08-08: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-38181 - CVSS 8.8 (high), 2023-08-08: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2023-35388 - CVSS 8 (high), 2023-08-08: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-35368 - CVSS 8.8 (high), 2023-08-08: Microsoft Exchange Remote Code Execution Vulnerability
• CVE-2023-21709 - CVSS 9.8 (critical), 2023-08-08: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2023-32031 - CVSS 8.8 (high), 2023-06-14: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-28310 - CVSS 8 (high), 2023-06-14: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-21710 - CVSS 7.2 (high), 2023-02-14: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-21707 - CVSS 8.8 (high), 2023-02-14: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-21706 - CVSS 8.8 (high), 2023-02-14: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-21529 - CVSS 8.8 (high), 2023-02-14: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2023-21764 - CVSS 7.8 (high), 2023-01-10: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2023-21763 - CVSS 7.8 (high), 2023-01-10: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2023-21762 - CVSS 8 (high), 2023-01-10: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2023-21761 - CVSS 7.5 (high), 2023-01-10: Microsoft Exchange Server Information Disclosure Vulnerability
• CVE-2023-21745 - CVSS 8 (high), 2023-01-10: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2022-41123 - CVSS 7.8 (high), 2022-11-09: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2022-41078 - CVSS 8 (high), 2022-11-09: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2022-41080 - CVSS 9.8 (critical), 2022-11-09: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2022-41079 - CVSS 8 (high), 2022-11-09: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2022-41082 - CVSS 8 (high), 2022-10-03: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2022-41040 - CVSS 8.8 (high), 2022-10-03: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2022-34692 - CVSS 5.3 (medium), 2022-08-09: Microsoft Exchange Server Information Disclosure Vulnerability
• CVE-2022-21980 - CVSS 8 (high), 2022-08-09: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2022-30134 - CVSS 6.5 (medium), 2022-08-09: Microsoft Exchange Server Information Disclosure Vulnerability
• CVE-2022-21979 - CVSS 5.7 (medium), 2022-08-09: Microsoft Exchange Server Information Disclosure Vulnerability
• CVE-2022-24516 - CVSS 8 (high), 2022-08-09: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2022-24477 - CVSS 8 (high), 2022-08-09: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2022-21978 - CVSS 8.2 (high), 2022-05-10: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2022-24463 - CVSS 6.5 (medium), 2022-03-09: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2022-23277 - CVSS 8.8 (high), 2022-03-09: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2022-21969 - CVSS 9 (critical), 2022-01-11: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2022-21855 - CVSS 9 (critical), 2022-01-11: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2022-21846 - CVSS 9 (critical), 2022-01-11: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-42321 - CVSS 8.8 (high), 2021-11-10: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-42305 - CVSS 6.5 (medium), 2021-11-10: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2021-41349 - CVSS 6.5 (medium), 2021-11-10: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2021-41348 - CVSS 8 (high), 2021-10-13: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2021-41350 - CVSS 6.5 (medium), 2021-10-13: Microsoft Exchange Server Spoofing Vulnerability
• CVE-2021-34453 - CVSS 7.5 (high), 2021-10-13: Microsoft Exchange Server Denial of Service Vulnerability
• CVE-2021-26427 - CVSS 9.6 (critical), 2021-10-13: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-34523 - CVSS 9.8 (critical), 2021-07-14: Microsoft Exchange Server Elevation of Privilege Vulnerability
• CVE-2021-34473 - CVSS 9.8 (critical), 2021-07-14: Microsoft Exchange Server Remote Code Execution Vulnerability
• CVE-2021-34470 - CVSS 8 (high), 2021-07-14: Microsoft Exchange Server Elevation of Privilege Vulnerability