Microsoft Exchange Server security vulnerabilities
Enterprise software. Public CVE monitoring for Microsoft Exchange Server. Vendor security advisories are linked on this page.
Built for IT administrators and security teams.
250 public records · 0 security-fix timeline events. 0 published in the last 7 days. 244 store a version range.
What you can do here
Current vulnerabilities
KEV-first priority plus newest publications for this stack.
Verified security fixes
Timeline events and, for Odoo, Community Git patch evidence — not keyword-only guesses.
Monitoring
Watch this technology from your account when you want alerts on new matches.
Patch intelligence
Use version checkers and advisory links to confirm upgrades before you change production.
- Critical 3
- High 15
- Medium 6
- Low 0
2026-08-0424 issues2026-11-01
Known exploited
View all known exploited- Medium6.1Microsoft Exchange Server Cross-Site Scripting VulnerabilityPatch nowKEVEPSS 70.66%May 14, 2026
- High8.8Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityPatch nowKEVEPSS 59.29%Feb 14, 2023
- Critical9.8Microsoft Exchange Server Privilege Escalation VulnerabilityPatch nowKEVEPSS 12.66%Feb 13, 2024
- High8.8Microsoft Exchange Server Privilege Escalation VulnerabilityPatch nowKEVEPSS 77.33%Nov 9, 2022
- High8.4Microsoft Exchange Server Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')Patch nowKEVEPSS 46.50%Sep 11, 2020
- High8.0Microsoft Exchange Server Remote Code Execution VulnerabilityPatch nowKEVEPSS 99.97%Sep 29, 2022
- High8.8Microsoft Exchange Server Server-Side Request Forgery VulnerabilityPatch nowKEVEPSS 99.96%Sep 29, 2022
- High7.2Microsoft Exchange Server Information Disclosure VulnerabilityPatch nowKEVEPSS 54.06%Jul 14, 2021
Recently published
Browse catalog- High7.5Microsoft Exchange Online Remote Code Execution VulnerabilityCheck if you run itEPSS 0.54%Oct 22, 2026
- High7.8Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.29%Oct 13, 2026
- High7.5Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.42%Oct 13, 2026
- High8.8Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 2.75%Oct 2, 2026
- Medium5.9Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 0.47%Sep 8, 2026
- High7.5Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.Check if you run itEPSS 1.17%Sep 8, 2026
- Medium6.5Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.Check if you run itEPSS 0.64%Sep 8, 2026
- High8.8External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.Check if you run itEPSS 0.91%Sep 8, 2026
- High8.1Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.Check if you run itEPSS 0.71%Sep 8, 2026
- Medium6.5Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.Check if you run itEPSS 0.64%Aug 11, 2026