Microsoft Exchange Server Subscription Edition vulnerabilities

CVE-2026-42897 [MEDIUM] CWE-79 CVE-2026-42897: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-59249 [HIGH] CWE-1390 CVE-2025-59249: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-55005 [HIGH] CWE-122 CVE-2026-55005: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute cod Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVE-2026-45504 [HIGH] CWE-918 CVE-2026-45504: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to ele Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-45583 [HIGH] CWE-94 CVE-2026-45583: Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an una Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVE-2025-64666 [HIGH] CWE-20 CVE-2025-64666: Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate priv Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-53786 [HIGH] CWE-287 CVE-2025-53786: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance an

CVE-2026-55009 [HIGH] CWE-502 CVE-2026-55009: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elev Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

CVE-2025-59248 [HIGH] CWE-20 CVE-2025-59248: Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform sp Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-55008 [CRITICAL] CWE-79 CVE-2026-55008: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-53782 [HIGH] CWE-303 CVE-2025-53782: Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthor Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.

CVE-2026-55006 [HIGH] CWE-1220 CVE-2026-55006: Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacke Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

CVE-2025-33051 [HIGH] CWE-200 CVE-2025-33051: Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an un Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

CVE-2026-45502 [MEDIUM] CWE-918 CVE-2026-45502: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to dis Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

CVE-2025-25005 [MEDIUM] CWE-20 CVE-2025-25005: Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tamp Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

CVE-2026-45503 [MEDIUM] CWE-285 CVE-2026-45503: Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose inform Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

CVE-2026-45501 [MEDIUM] CWE-918 CVE-2026-45501: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to per Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

CVE-2025-25007 [MEDIUM] CWE-1286 CVE-2025-25007: Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unautho Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-25006 [MEDIUM] CWE-167 CVE-2025-25006: Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-45500 [MEDIUM] CWE-79 CVE-2026-45500: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.