Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilities
88 known vulnerabilities affecting microsoft/microsoft_exchange_server_2016_cumulative_update_23.
Total CVEs
88
CISA KEV
6
actively exploited
Public exploits
4
Exploited in wild
7
Severity breakdown
CRITICAL7HIGH60MEDIUM21
Vulnerabilities
Page 1 of 5
CVE-2022-41040P1HIGHCVSS 8.8KEVPoCRansomware≥ 15.01.0, < 15.01.2507.0162022-10-03
CVE-2022-41040 [HIGH] CWE-918 CVE-2022-41040: Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
nvd
CVE-2022-41082P1HIGHCVSS 8.0KEVPoCRansomware≥ 15.01.0, < 15.01.2507.0162022-10-03
CVE-2022-41082 [HIGH] CWE-502 CVE-2022-41082: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2022-41080P1CRITICALCVSS 9.8KEVPoCRansomware≥ 15.01.0, < 15.01.2507.0162022-11-09
CVE-2022-41080 [CRITICAL] CVE-2022-41080: Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
nvd
CVE-2026-42897P1MEDIUMCVSS 6.1KEVPoC≥ 15.01.0.0, < 15.01.2507.0692026-05-14
CVE-2026-42897 [MEDIUM] CWE-79 CVE-2026-42897: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
nvd
CVE-2023-21529P1HIGHCVSS 8.8KEVRansomware≥ 15.01.0, < 15.01.2507.0212023-02-14
CVE-2023-21529 [HIGH] CWE-502 CVE-2023-21529: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2024-21410P1CRITICALCVSS 9.8KEV≥ 15.01.0, < 15.01.2507.0372024-02-13
CVE-2024-21410 [CRITICAL] CWE-287 CVE-2024-21410: Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
nvd
CVE-2023-36745P1HIGHCVSS 8.0Exploited≥ 15.01.0, < 15.01.2507.0322023-09-12
CVE-2023-36745 [HIGH] CWE-502 CVE-2023-36745: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2023-21707P2HIGHCVSS 8.8≥ 15.01.0, < 15.01.2507.0232023-02-14
CVE-2023-21707 [HIGH] CWE-502 CVE-2023-21707: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2023-32031P2HIGHCVSS 8.8≥ 15.01.0, < 15.01.2507.0272023-06-14
CVE-2023-32031 [HIGH] CWE-502 CVE-2023-32031: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2023-36744P2HIGHCVSS 8.0≥ 15.01.0, < 15.01.2507.0322023-09-12
CVE-2023-36744 [HIGH] CWE-502 CVE-2023-36744: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2023-36756P2HIGHCVSS 8.0≥ 15.01.0, < 15.01.2507.0322023-09-12
CVE-2023-36756 [HIGH] CWE-502 CVE-2023-36756: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2026-96940P2HIGHCVSS 8.8≥ 15.01.0.0, < 15.01.2507.0752026-10-02
CVE-2026-96940 [HIGH] CWE-1390 CVE-2026-96940: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-69355P2HIGHCVSS 8.8≥ 15.01.0.0, < 15.01.2507.0732026-09-08
CVE-2026-69355 [HIGH] CWE-73 CVE-2026-69355: External control of file name or path in Microsoft Exchange Server allows an authorized attacker to
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
nvd
CVE-2026-55005P2HIGHCVSS 8.8≥ 15.01.0.0, < 15.01.2507.0712026-07-14
CVE-2026-55005 [HIGH] CWE-122 CVE-2026-55005: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute cod
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
nvd
CVE-2026-62913P2HIGHCVSS 8.8≥ 15.01.0.0, < 15.01.2507.0722026-08-11
CVE-2026-62913 [HIGH] CWE-122 CVE-2026-62913: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute cod
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
nvd
CVE-2026-77910P2HIGHCVSS 8.8≥ 15.01.0.0, < 15.01.2507.0772026-10-13
CVE-2026-77910 [HIGH] CWE-863 CVE-2026-77910: Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privil
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2023-28310P3HIGHCVSS 8.0≥ 15.01.0, < 15.01.2507.0272023-06-14
CVE-2023-28310 [HIGH] CWE-502 CVE-2023-28310: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
CVE-2026-45504P2HIGHCVSS 8.8≥ 15.01.0.0, < 15.01.2507.0712026-06-09
CVE-2026-45504 [HIGH] CWE-918 CVE-2026-45504: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to ele
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2026-62910P2HIGHCVSS 8.8≥ 15.01.0.0, < 15.01.2507.0722026-08-11
CVE-2026-62910 [HIGH] CWE-99 CVE-2026-62910: Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows
Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
nvd
CVE-2023-21706P2HIGHCVSS 8.8≥ 15.01.0, < 15.01.2507.0212023-02-14
CVE-2023-21706 [HIGH] CWE-502 CVE-2023-21706: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
nvd
1 / 5Next →