Microsoft Exchange Server 2019 Cumulative Update 14 vulnerabilities

CVE-2026-42897 [MEDIUM] CWE-79 CVE-2026-42897: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2024-21410 [CRITICAL] CWE-287 CVE-2024-21410: Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2026-96940 [HIGH] CWE-1390 CVE-2026-96940: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-69355 [HIGH] CWE-73 CVE-2026-69355: External control of file name or path in Microsoft Exchange Server allows an authorized attacker to External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVE-2026-55005 [HIGH] CWE-122 CVE-2026-55005: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute cod Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVE-2026-62913 [HIGH] CWE-122 CVE-2026-62913: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute cod Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVE-2026-77910 [HIGH] CWE-863 CVE-2026-77910: Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privil Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-45504 [HIGH] CWE-918 CVE-2026-45504: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to ele Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-62910 [HIGH] CWE-99 CVE-2026-62910: Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-65813 [HIGH] CWE-918 CVE-2026-65813: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to ele Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-59249 [HIGH] CWE-1390 CVE-2025-59249: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2024-26198 [HIGH] CWE-426 CVE-2024-26198: Microsoft Exchange Server Remote Code Execution Vulnerability Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2026-70571 [HIGH] CWE-121 CVE-2026-70571: Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVE-2026-69641 [CRITICAL] CWE-862 CVE-2026-69641: Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileg Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-55007 [HIGH] CWE-415 CVE-2026-55007: Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a netw Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVE-2026-69380 [HIGH] CWE-862 CVE-2026-69380: Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileg Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-45583 [HIGH] CWE-94 CVE-2026-45583: Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an una Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVE-2026-62911 [HIGH] CWE-294 CVE-2026-62911: Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker t Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-64666 [HIGH] CWE-20 CVE-2025-64666: Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate priv Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-87696 [HIGH] CWE-347 CVE-2026-87696: Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized a Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.