Microsoft Exchange Server vulnerabilities

CVE-2026-45502 [MEDIUM] CWE-918 CVE-2026-45502: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to dis Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

CVE-2025-33051 [HIGH] CWE-200 CVE-2025-33051: Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an un Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

CVE-2021-31198 [HIGH] CWE-20 CVE-2021-31198: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2026-62912 [MEDIUM] CWE-502 CVE-2026-62912: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.

CVE-2026-69361 [MEDIUM] CWE-918 CVE-2026-69361: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to per Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

CVE-2026-69375 [MEDIUM] CWE-639 CVE-2026-69375: Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized a Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

CVE-1999-0385 [CRITICAL] CWE-120 CVE-1999-0385: The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduc The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduct a denial of service or execute commands.

CVE-2019-1233 [HIGH] CVE-2019-1233: A denial of service vulnerability exists in Microsoft Exchange Server software when the software fai A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Denial of Service Vulnerability'.

CVE-2026-62915 [MEDIUM] CWE-862 CVE-2026-62915: Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a securit Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.

CVE-2010-0025 [MEDIUM] CWE-200 CVE-2010-0025: The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 G The SMTP component in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP2, and Server 2008 Gold, SP2, and R2, and Exchange Server 2000 SP3, does not properly allocate memory for SMTP command replies, which allows remote attackers to read fragments of e-mail messages by sending a series of invalid commands and then sending a STARTTLS command, a

CVE-2002-0698 [HIGH] CWE-120 CVE-2002-0698: Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote att Buffer overflow in Internet Mail Connector (IMC) for Microsoft Exchange Server 5.5 allows remote attackers to execute arbitrary code via an EHLO request from a system with a long name as obtained through a reverse DNS lookup, which triggers the overflow in IMC's hello response.

CVE-2021-41348 [HIGH] CWE-269 CVE-2021-41348: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2023-21763 [HIGH] CWE-426 CVE-2023-21763: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2022-41123 [HIGH] CVE-2022-41123: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2023-21761 [HIGH] CWE-918 CVE-2023-21761: Microsoft Exchange Server Information Disclosure Vulnerability Microsoft Exchange Server Information Disclosure Vulnerability

CVE-2007-0220 [MEDIUM] CWE-79 CVE-2007-0220: Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 20 Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".

CVE-2023-21764 [HIGH] CWE-426 CVE-2023-21764: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2025-25005 [MEDIUM] CWE-20 CVE-2025-25005: Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tamp Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

CVE-2026-45503 [MEDIUM] CWE-285 CVE-2026-45503: Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose inform Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

CVE-2013-0418 [MEDIUM] CVE-2013-0418: Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via unknown vectors related to Outside In Filters, a different vulnerability than CVE-2013-0393. NOTE: the previous information was obtained from the January 2013 CPU. Oracle has not comment