Microsoft Exchange Server vulnerabilities
79 known CVE vulnerabilities in Microsoft Exchange Server, translated and rated.
- CVE-2026-62913High
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
- CVE-2026-62912Medium
A deserialization of untrusted data vulnerability in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
- CVE-2026-62911High
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-62910High
Improper control of resource identifiers (resource injection) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-55009High
A deserialization of untrusted data vulnerability in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
- CVE-2026-55006High
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
- CVE-2026-55005High
A heap-based buffer overflow vulnerability in Microsoft Exchange Server allows an authorized attacker to execute code remotely over a network.
- CVE-2026-47631High
A cross-site scripting (XSS) vulnerability in Microsoft Exchange Server due to improper input neutralization during web page generation. Allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-45583High
Code injection vulnerability in Microsoft Exchange Server. An unauthorized attacker can remotely execute code over the network.
- CVE-2026-45504High
Server-Side Request Forgery (SSRF) vulnerability in Microsoft Exchange Server. An authorized attacker can elevate privileges over a network.
- CVE-2026-45503High
Improper authorization vulnerability in Microsoft Exchange Server. An authorized attacker can exploit this vulnerability to disclose information over a network.
- CVE-2026-45501Medium
Server-side request forgery (SSRF) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
- CVE-2026-45500Medium
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server. An unauthorized attacker can perform spoofing over a network.
- CVE-2025-64667Medium
A flaw in the user interface of Microsoft Exchange Server leads to misrepresentation of critical information, allowing an unauthorized attacker to perform spoofing over a network.
- CVE-2025-64666High
Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2025-59249High
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2025-59248High
Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- CVE-2025-53782High
Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.
- CVE-2025-33051High
Microsoft Exchange Server has a vulnerability that allows an unauthorized attacker to disclose sensitive information over a network.
- CVE-2025-25007Medium
Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- CVE-2025-25006Medium
Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- CVE-2025-25005Medium
Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
- CVE-2023-38185High
A vulnerability in Microsoft Exchange Server allows for remote code execution by an attacker. Exploiting this flaw could lead to system takeover.
- CVE-2023-21706High
Remote code execution vulnerability in Microsoft Exchange Server. An attacker could exploit it to run arbitrary code on the server.
- CVE-2022-41123High
Elevation of privilege vulnerability in Microsoft Exchange Server. It allows an attacker to elevate their privileges in the Exchange environment.
- CVE-2022-41079High
Spoofing vulnerability in Microsoft Exchange Server. Allows an attacker to impersonate another user or sender.
- CVE-2022-41078High
A spoofing vulnerability in Microsoft Exchange Server allows an attacker to impersonate another entity in communication.
- CVE-2021-34470High
Elevation of privilege vulnerability in Microsoft Exchange Server. Allows an attacker to gain higher privileges.
- CVE-2021-33768High
Vulnerability in Microsoft Exchange Server allows elevation of privilege. Attacker can gain higher privileges in the system.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS

