Exchange Server Subscription Edition (Microsoft) - vulnerabilities (CVEs)

42 CVEs, 3 in the last 30 days, 11 known versions, newest CVE from 2026-10-13. Vendor: Microsoft.

CVEs of Exchange Server Subscription Edition

• CVE-2026-87696 - CVSS 7.5 (high), 2026-10-13: Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-87695 - CVSS 7.8 (high), 2026-10-13: Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-96940 - CVSS 8.8 (high), 2026-10-02: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-69641 - CVSS 9.1 (critical), 2026-09-08: Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-69382 - CVSS 5.9 (medium), 2026-09-08: Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
• CVE-2026-69380 - CVSS 8.1 (high), 2026-09-08: Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-69378 - CVSS 7.5 (high), 2026-09-08: Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
• CVE-2026-69375 - CVSS 6.5 (medium), 2026-09-08: Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
• CVE-2026-69356 - CVSS 9.3 (critical), 2026-09-08: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…
• CVE-2026-69361 - CVSS 6.5 (medium), 2026-09-08: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
• CVE-2026-69355 - CVSS 8.8 (high), 2026-09-08: External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
• CVE-2026-55007 - CVSS 8.1 (high), 2026-09-08: Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-62911 - CVSS 8 (high), 2026-08-11: Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-65813 - CVSS 8.8 (high), 2026-08-11: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-62915 - CVSS 6.5 (medium), 2026-08-11: Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.
• CVE-2026-62914 - CVSS 7.3 (high), 2026-08-11: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform…
• CVE-2026-62912 - CVSS 6.5 (medium), 2026-08-11: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
• CVE-2026-62913 - CVSS 8.8 (high), 2026-08-11: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
• CVE-2026-62910 - CVSS 8.8 (high), 2026-08-11: Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-55009 - CVSS 7.8 (high), 2026-07-14: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-55008 - CVSS 9.6 (critical), 2026-07-14: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…
• CVE-2026-55006 - CVSS 7.8 (high), 2026-07-14: Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
• CVE-2026-55005 - CVSS 8.8 (high), 2026-07-14: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
• CVE-2026-47631 - CVSS 8.1 (high), 2026-06-09: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…
• CVE-2026-45504 - CVSS 8.8 (high), 2026-06-09: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2026-45503 - CVSS 8.1 (high), 2026-06-09: Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
• CVE-2026-45502 - CVSS 5 (medium), 2026-06-09: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
• CVE-2026-45583 - CVSS 8.1 (high), 2026-06-09: Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
• CVE-2026-45501 - CVSS 6.5 (medium), 2026-06-09: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
• CVE-2026-45500 - CVSS 6.1 (medium), 2026-06-09: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…
• CVE-2026-42897 - CVSS 8.1 (high), 2026-05-14: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform…
• CVE-2026-21527 - CVSS 6.5 (medium), 2026-02-10: User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-64667 - CVSS 5.3 (medium), 2025-12-09: User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-64666 - CVSS 7.5 (high), 2025-12-09: Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2025-59249 - CVSS 8.8 (high), 2025-10-14: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
• CVE-2025-59248 - CVSS 7.5 (high), 2025-10-14: Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-53782 - CVSS 8.4 (high), 2025-10-14: Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.
• CVE-2025-33051 - CVSS 7.5 (high), 2025-08-12: Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
• CVE-2025-25007 - CVSS 5.3 (medium), 2025-08-12: Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-25006 - CVSS 5.3 (medium), 2025-08-12: Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
• CVE-2025-25005 - CVSS 6.5 (medium), 2025-08-12: Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
• CVE-2025-53786 - CVSS 8 (high), 2025-08-06: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these…