Microsoft Exchange Server vulnerabilities

CVE-2026-55008 [CRITICAL] CWE-79 CVE-2026-55008: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2023-36777 [MEDIUM] CWE-502 CVE-2023-36777: Microsoft Exchange Server Information Disclosure Vulnerability Microsoft Exchange Server Information Disclosure Vulnerability

CVE-2026-69356 [CRITICAL] CWE-79 CVE-2026-69356: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2023-36778 [HIGH] CWE-426 CVE-2023-36778: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2007-0039 [HIGH] CWE-476 CVE-2007-0039: The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, The Exchange Collaboration Data Objects (EXCDO) functionality in Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 allows remote attackers to cause a denial of service (crash) via an Internet Calendar (iCal) file containing multiple X-MICROSOFT-CDO-MODPROPS (MODPROPS) properties in which the second MODPROPS is longer than the first, which t

CVE-2010-2091 [MEDIUM] CWE-79 CVE-2010-2091: Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is use Microsoft Outlook Web Access (OWA) 8.2.254.0, when Internet Explorer 7 on Windows Server 2003 is used, does not properly handle the id parameter in a Folder IPF.Note action to the default URI, which might allow remote attackers to obtain sensitive information or conduct cross-site scripting (XSS) attacks via an invalid value.

CVE-2006-1193 [LOW] CWE-79 CVE-2006-1193: Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when run Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2000 SP1 through SP3, when running Outlook Web Access (OWA), allows user-assisted remote attackers to inject arbitrary HTML or web script via unknown vectors related to "HTML parsing."

CVE-2007-0221 [HIGH] CWE-190 CVE-2007-0221: Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote att Integer overflow in the IMAP (IMAP4) support in Microsoft Exchange Server 2000 SP3 allows remote attackers to cause a denial of service (service hang) via crafted literals in an IMAP command, aka the "IMAP Literal Processing Vulnerability."

CVE-2026-55006 [HIGH] CWE-1220 CVE-2026-55006: Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacke Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

CVE-2016-3378 [HIGH] CWE-20 CVE-2016-3378: Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 C Open redirect vulnerability in Microsoft Exchange Server 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a crafted URL, aka "Microsoft Exchange Open Redirect Vulnerability."

CVE-2026-69378 [HIGH] CWE-674 CVE-2026-69378: Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.

CVE-2025-59248 [HIGH] CWE-20 CVE-2025-59248: Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform sp Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2019-1136 [HIGH] CVE-2019-1136: An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.

CVE-2020-0692 [HIGH] CVE-2020-0692: An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.

CVE-2017-11932 [HIGH] CWE-20 CVE-2017-11932: Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerabi Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web requests, aka "Microsoft Exchange Spoofing Vulnerability".

CVE-2025-53782 [HIGH] CWE-303 CVE-2025-53782: Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthor Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.

CVE-2019-0686 [HIGH] CVE-2019-0686: An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'. This CVE ID is unique from CVE-2019-0724.

CVE-2022-21980 [HIGH] CVE-2022-21980: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2022-24516 [HIGH] CVE-2022-24516: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2022-24477 [HIGH] CVE-2022-24477: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability