CVE-2026-55005
HighCVSS 8.8Exploitation Probability (EPSS)
Low risk48th percentile - higher than 48% of all known CVEs
Summary
A heap-based buffer overflow vulnerability in Microsoft Exchange Server allows an authorized attacker to execute code remotely over a network.
Risk Assessment
An attacker could take control of the Exchange server, compromising the confidentiality, integrity, and availability of organizational data.
Recommendation
Immediately apply the security update provided by Microsoft for Exchange Server.
Other vulnerabilities in Microsoft Exchange Server
See all- CVE-2026-55008Critical
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network. The flaw is due to improper neutralization of input during web page generation.
- CVE-2026-45502Medium
A Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
- CVE-2026-42897HighActively exploited
Microsoft Exchange Server has an improper neutralization of input during web page generation, leading to a cross-site scripting vulnerability. This flaw allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-21527Medium
A flaw in the user interface of Microsoft Exchange Server leads to misrepresentation of critical information, allowing an unauthorized attacker to perform spoofing over a network.
- CVE-2025-53786High
On April 18th, 2025, Microsoft announced security changes for Exchange Server in hybrid deployments and accompanying hot fixes. Further investigation revealed specific security implications related to these changes.
- CVE-2023-38182High
A vulnerability in Microsoft Exchange Server allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
- CVE-2023-38181High
A vulnerability in Microsoft Exchange Server allows attackers to spoof other email addresses. Exploiting this flaw could lead to email communication fraud.
- CVE-2023-35388High
A vulnerability in Microsoft Exchange Server allows for remote code execution. An attacker can exploit this flaw to gain control over the system.
- CVE-2023-21709Critical
Elevation of privilege vulnerability in Microsoft Exchange Server. It allows an attacker to elevate their privileges in the system.
- CVE-2023-21707High
Remote code execution vulnerability in Microsoft Exchange Server. Allows an attacker to execute arbitrary code in the context of the Exchange server.
Original NVD description (English source)
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.