Microsoft Exchange Server Subscription Edition vulnerabilities

CVE-2026-69378 [HIGH] CWE-674 CVE-2026-69378: Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.

CVE-2025-59248 [HIGH] CWE-20 CVE-2025-59248: Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform sp Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-53782 [HIGH] CWE-303 CVE-2025-53782: Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthor Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.

CVE-2026-45502 [MEDIUM] CWE-918 CVE-2026-45502: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to dis Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

CVE-2025-33051 [HIGH] CWE-200 CVE-2025-33051: Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an un Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

CVE-2026-62912 [MEDIUM] CWE-502 CVE-2026-62912: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.

CVE-2026-69361 [MEDIUM] CWE-918 CVE-2026-69361: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to per Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

CVE-2026-69375 [MEDIUM] CWE-639 CVE-2026-69375: Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized a Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

CVE-2026-62915 [MEDIUM] CWE-862 CVE-2026-62915: Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a securit Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.

CVE-2025-25005 [MEDIUM] CWE-20 CVE-2025-25005: Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tamp Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

CVE-2026-45503 [MEDIUM] CWE-285 CVE-2026-45503: Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose inform Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

CVE-2026-69382 [MEDIUM] CWE-327 CVE-2026-69382: Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

CVE-2026-45501 [MEDIUM] CWE-918 CVE-2026-45501: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to per Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

CVE-2025-25007 [MEDIUM] CWE-1286 CVE-2025-25007: Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unautho Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-45500 [MEDIUM] CWE-79 CVE-2026-45500: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-25006 [MEDIUM] CWE-167 CVE-2025-25006: Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-62914 [MEDIUM] CWE-79 CVE-2026-62914: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

CVE-2026-47631 [MEDIUM] CWE-79 CVE-2026-47631: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.