Microsoft Exchange Server vulnerabilities

CVE-2026-55006 [HIGH] CWE-1220 CVE-2026-55006: Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacke Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

CVE-2019-1136 [HIGH] CVE-2019-1136: An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.

CVE-2020-0692 [HIGH] CVE-2020-0692: An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.

CVE-2016-3378 [HIGH] CWE-20 CVE-2016-3378: Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 C Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "Microsoft Exchange Open Redirect Vulnerability."

CVE-2025-33051 [HIGH] CWE-200 CVE-2025-33051: Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an un Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

CVE-2021-31198 [HIGH] CWE-20 CVE-2021-31198: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2019-0686 [HIGH] CVE-2019-0686: An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0724.

CVE-2022-24516 [HIGH] CVE-2022-24516: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2022-24477 [HIGH] CVE-2022-24477: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2026-45502 [MEDIUM] CWE-918 CVE-2026-45502: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to dis Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

CVE-2017-11932 [HIGH] CWE-20 CVE-2017-11932: Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerabi Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web requests, aka "Microsoft Exchange Spoofing Vulnerability".

CVE-2022-21980 [HIGH] CVE-2022-21980: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2010-0025 [MEDIUM] CWE-200 CVE-2010-0025: The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 G The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2000 SP3, does not properly allocate memory for SMTP command replies, which allows remote attackers to read fragments of e-mail messages by sending a series of invalid commands and then sending a STARTTLS command, a

CVE-1999-0385 [CRITICAL] CWE-120 CVE-1999-0385: The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduc The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduct a denial of service or execute commands.

CVE-2002-0698 [HIGH] CWE-120 CVE-2002-0698: Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote att Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained through a reverse DNS lookup, which triggers the overflow in IMC's hello response.

CVE-2021-41348 [HIGH] CWE-269 CVE-2021-41348: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2007-0220 [MEDIUM] CWE-79 CVE-2007-0220: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 20 Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".

CVE-2023-21763 [HIGH] CWE-426 CVE-2023-21763: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2022-41123 [HIGH] CVE-2022-41123: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2023-21764 [HIGH] CWE-426 CVE-2023-21764: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability