Microsoft Exchange Server Subscription Edition vulnerabilities

CVE-2026-42897 [MEDIUM] CWE-79 CVE-2026-42897: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-96940 [HIGH] CWE-1390 CVE-2026-96940: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-69355 [HIGH] CWE-73 CVE-2026-69355: External control of file name or path in Microsoft Exchange Server allows an authorized attacker to External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVE-2026-55005 [HIGH] CWE-122 CVE-2026-55005: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute cod Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVE-2026-62913 [HIGH] CWE-122 CVE-2026-62913: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute cod Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVE-2026-45504 [HIGH] CWE-918 CVE-2026-45504: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to ele Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-62910 [HIGH] CWE-99 CVE-2026-62910: Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-65813 [HIGH] CWE-918 CVE-2026-65813: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to ele Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-59249 [HIGH] CWE-1390 CVE-2025-59249: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-69641 [CRITICAL] CWE-862 CVE-2026-69641: Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileg Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-55007 [HIGH] CWE-415 CVE-2026-55007: Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a netw Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVE-2026-69380 [HIGH] CWE-862 CVE-2026-69380: Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileg Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-45583 [HIGH] CWE-94 CVE-2026-45583: Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an una Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVE-2026-62911 [HIGH] CWE-294 CVE-2026-62911: Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker t Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-64666 [HIGH] CWE-20 CVE-2025-64666: Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate priv Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-55009 [HIGH] CWE-502 CVE-2026-55009: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elev Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

CVE-2025-53786 [HIGH] CWE-287 CVE-2025-53786: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance an

CVE-2026-55008 [CRITICAL] CWE-79 CVE-2026-55008: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-69356 [CRITICAL] CWE-79 CVE-2026-69356: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-55006 [HIGH] CWE-1220 CVE-2026-55006: Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacke Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.