Microsoft Exchange Server vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
250 matching records
- High7.5Microsoft Exchange Online Remote Code Execution VulnerabilityCheck if you run itEPSS 0.54%Oct 22, 2026
- High7.5Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.42%Oct 13, 2026
- High7.8Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.29%Oct 13, 2026
- High7.8Affected Microsoft products: Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server Subscription Edition RTM, Microsoft Exchange Server 2016 Cu…Check if you run itEPSS 2.31%Oct 13, 2026
- High8.8Affected Microsoft products: Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 C…Check if you run itEPSS 0.87%Oct 13, 2026
- High8.1Affected Microsoft products: Microsoft Exchange Server Subscription Edition RTM, Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Exchange Server 2019 Cu…Check if you run itEPSS 1.39%Oct 13, 2026
- Critical9.3Affected Microsoft products: Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Exchange Server Subscr…Check if you run itEPSS 1.29%Oct 13, 2026
- High8.8Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 2.75%Oct 2, 2026
- Critical9.1CVE-2026-69641 is listed by Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network..Check if you run itEPSS 0.86%Sep 8, 2026
- Medium5.9Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 0.47%Sep 8, 2026
- High8.1CVE-2026-69380 is listed by Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network..Check if you run itEPSS 0.69%Sep 8, 2026
- High7.5Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.Check if you run itEPSS 1.17%Sep 8, 2026
- Medium6.5Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.Check if you run itEPSS 0.64%Sep 8, 2026
- Medium6.5CVE-2026-69361 is listed by Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network..Check if you run itEPSS 0.84%Sep 8, 2026
- Critical9.3CVE-2026-69356 is listed by inventory_critical.Check if you run itEPSS 0.76%Sep 8, 2026
- High8.8External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.Check if you run itEPSS 0.91%Sep 8, 2026
- High8.1Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.Check if you run itEPSS 0.71%Sep 8, 2026
- High8.8CVE-2026-65813 is listed by Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network..Check if you run itEPSS 0.94%Aug 11, 2026
- Medium6.5Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.Check if you run itEPSS 0.64%Aug 11, 2026
- Medium5.4Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.Check if you run itEPSS 0.45%Aug 11, 2026
- High8.8CVE-2026-62913 is listed by Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network..Check if you run itEPSS 0.91%Aug 11, 2026
- Medium6.5Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.Check if you run itEPSS 1.98%Aug 11, 2026
- High8.0Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.69%Aug 11, 2026
- High8.8Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 1.00%Aug 11, 2026
- High7.8CVE-2026-55009 is listed by Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally..Check if you run itEPSS 2.51%Jul 14, 2026