Microsoft Exchange Server vulnerabilities
Filtered catalog for this technology stack. Use KEV and EPSS sorting to prioritize — then open each CVE for remediation and version matching.
250 matching records
- Critical9.6CVE-2026-55008 is listed by inventory_critical.Check if you run itEPSS 0.86%Jul 14, 2026
- High7.8Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.Check if you run itEPSS 0.30%Jul 14, 2026
- High8.8Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.Check if you run itEPSS 1.01%Jul 14, 2026
- Medium5.4CVE-2026-47631 is listed by inventory_critical.Check if you run itEPSS 0.35%Jun 9, 2026
- High8.1Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.Check if you run itEPSS 0.52%Jun 9, 2026
- High8.8CVE-2026-45504 is listed by Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network..Check if you run itEPSS 1.18%Jun 9, 2026
- Medium6.5Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.Check if you run itEPSS 0.45%Jun 9, 2026
- Medium5.0Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.Check this weekEPSS 20.26%Jun 9, 2026
- Medium6.1CVE-2026-45501 is listed by Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network..Check if you run itEPSS 0.40%Jun 9, 2026
- Medium6.1CVE-2026-45500 is listed by inventory_critical.Check if you run itEPSS 0.38%Jun 9, 2026
- Medium6.1Microsoft Exchange Server Cross-Site Scripting VulnerabilityPatch nowKEVEPSS 70.66%May 14, 2026
- Critical9.9Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.55%Mar 19, 2026
- Medium6.5CVE-2026-21527 is listed by User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoof…Check if you run itEPSS 8.26%Feb 10, 2026
- High7.5Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 1.02%Dec 9, 2025
- Medium5.3User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.Check if you run itEPSS 0.80%Dec 9, 2025
- High8.8Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.Check if you run itEPSS 0.83%Oct 14, 2025
- High7.5Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.Check if you run itEPSS 1.02%Oct 14, 2025
- High8.4Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.Check if you run itEPSS 0.36%Oct 14, 2025
- High7.5Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.Check if you run itEPSS 1.27%Aug 12, 2025
- Medium5.3Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.Check if you run itEPSS 0.87%Aug 12, 2025
- Medium5.3Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.Check if you run itEPSS 0.89%Aug 12, 2025
- Medium6.5Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.Check if you run itEPSS 1.41%Aug 12, 2025
- High8.0On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix.Check if you run itEPSS 7.59%Aug 6, 2025
- High7.5CVE-2024-49040 is listed by Microsoft Exchange Server Spoofing Vulnerability.Check if you run itEPSS 8.47%Nov 12, 2024
- UnknownMicrosoft Exchange Server Remote Code Execution VulnerabilityPatch nowKEVEPSS 36.24%Jul 25, 2024