cbcvebase.

Microsoft Exchange Server vulnerabilities

236 known vulnerabilities affecting microsoft/exchange_server.

Total CVEs
236
CISA KEV
20
actively exploited
Public exploits
46
Exploited in wild
29
Severity breakdown
CRITICAL27HIGH98MEDIUM105LOW6

Vulnerabilities

Page 5 of 12
CVE-2018-8265P3HIGHCVSS 7.8v2013-cumulative_update_21v2016-cumulative_update_102018-10-10
CVE-2018-8265 [HIGH] CWE-20 CVE-2018-8265: A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Code Execution Vulnerability." This affects Microsoft Exchange Server.
nvd
CVE-2026-62911P3HIGHCVSS 8.0v2016v2016-cumulative_update_1+35 more2026-08-11
CVE-2026-62911 [HIGH] CWE-294 CVE-2026-62911: Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker t Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2005-1987P3HIGHCVSS 7.5v20002005-10-13
CVE-2005-1987 [HIGH] CWE-120 CVE-2005-1987: Buffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exch Buffer overflow in Collaboration Data Objects (CDO), as used in Microsoft Windows and Microsoft Exchange Server, allows remote attackers to execute arbitrary code when CDOSYS or CDOEX processes an e-mail message with a large header name, as demonstrated using the "Content-Type" string.
nvd
CVE-2021-26427P3CRITICALCVSS 9.6v2013v2016+1 more2021-10-13
CVE-2021-26427 [CRITICAL] CVE-2021-26427: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2023-35368P3HIGHCVSS 8.8v2016-cumulative_update_23v2019-cumulative_update_12+1 more2023-08-08
CVE-2023-35368 [HIGH] CWE-20 CVE-2023-35368: Microsoft Exchange Remote Code Execution Vulnerability Microsoft Exchange Remote Code Execution Vulnerability
nvd
CVE-1999-0284P4HIGHCVSS 7.5PoCv4.0v5.01998-01-01
CVE-1999-0284 [HIGH] CWE-120 CVE-1999-0284: Denial of service to NT mail servers including Ipswitch, Mdaemon, and Exchange through a buffer over Denial of service to NT mail servers including Ipswitch, Mdaemon, and Exchange through a buffer overflow in the SMTP HELO command.
nvd
CVE-2005-0420P4MEDIUMCVSS 5.8PoCv20032005-04-27
CVE-2005-0420 [MEDIUM] CWE-601 CVE-2005-0420: Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect use Microsoft Outlook Web Access (OWA), when used with Exchange, allows remote attackers to redirect users to arbitrary URLs for login via a link to the owalogon.asp application.
nvd
CVE-2023-21710P3HIGHCVSS 7.2v2016v20192023-02-14
CVE-2023-21710 [HIGH] CWE-502 CVE-2023-21710: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2025-64666P3HIGHCVSS 7.5v2016v2016-cumulative_update_1+35 more2025-12-09
CVE-2025-64666 [HIGH] CWE-20 CVE-2025-64666: Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate priv Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2021-28483P3CRITICALCVSS 9.0v2013v2016+1 more2021-04-13
CVE-2021-28483 [CRITICAL] CVE-2021-28483: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2023-35388P3HIGHCVSS 8.0v2016-cumulative_update_23v2019-cumulative_update_12+1 more2023-08-08
CVE-2023-35388 [HIGH] CWE-502 CVE-2023-35388: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2023-38182P3HIGHCVSS 8.0v2016-cumulative_update_23v2019-cumulative_update_12+1 more2023-08-08
CVE-2023-38182 [HIGH] CWE-502 CVE-2023-38182: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2022-21969P3CRITICALCVSS 9.0v2013v2016+1 more2022-01-11
CVE-2022-21969 [CRITICAL] CVE-2022-21969: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2022-21846P3CRITICALCVSS 9.0v2013v2016+1 more2022-01-11
CVE-2022-21846 [CRITICAL] CVE-2022-21846: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2022-21855P3CRITICALCVSS 9.0v2013v2016+1 more2022-01-11
CVE-2022-21855 [CRITICAL] CVE-2022-21855: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2026-55009P3HIGHCVSS 7.8v2016-cumulative_update_23v2019-cumulative_update_14+1 more2026-07-14
CVE-2026-55009 [HIGH] CWE-502 CVE-2026-55009: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elev Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
nvd
CVE-2020-17141P3HIGHCVSS 8.4v2016v20192020-12-10
CVE-2020-17141 [HIGH] CVE-2020-17141: Microsoft Exchange Remote Code Execution Vulnerability Microsoft Exchange Remote Code Execution Vulnerability
nvd
CVE-2002-1790P4MEDIUMCVSS 5.0PoCv5.52002-12-31
CVE-2002-1790 [MEDIUM] CVE-2002-1790: The SMTP service in Microsoft Internet Information Services (IIS) 4.0 and 5.0 allows remote attacker The SMTP service in Microsoft Internet Information Services (IIS) 4.0 and 5.0 allows remote attackers to bypass anti-relaying rules and send spam or spoofed messages via encapsulated SMTP addresses, a similar vulnerability to CVE-1999-0682.
nvd
CVE-2023-36439P3HIGHCVSS 8.0v2016v20192023-11-14
CVE-2023-36439 [HIGH] CWE-502 CVE-2023-36439: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2025-53786P3HIGHCVSS 8.0v2016-cumulative_update_23v2019-cumulative_update_14+1 more2025-08-06
CVE-2025-53786 [HIGH] CWE-287 CVE-2025-53786: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance an
nvd
← Previous5 / 12Next →
Microsoft Exchange Server vulnerabilities | cvebase