Microsoft Exchange Server Subscription Edition Rtm vulnerabilities

CVE-2026-42897 [MEDIUM] CWE-79 CVE-2026-42897: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-96940 [HIGH] CWE-1390 CVE-2026-96940: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-69355 [HIGH] CWE-73 CVE-2026-69355: External control of file name or path in Microsoft Exchange Server allows an authorized attacker to External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVE-2026-55005 [HIGH] CWE-122 CVE-2026-55005: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute cod Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVE-2026-62913 [HIGH] CWE-122 CVE-2026-62913: Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute cod Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVE-2026-77910 [HIGH] CWE-863 CVE-2026-77910: Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privil Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-45504 [HIGH] CWE-918 CVE-2026-45504: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to ele Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-62910 [HIGH] CWE-99 CVE-2026-62910: Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-65813 [HIGH] CWE-918 CVE-2026-65813: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to ele Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-59249 [HIGH] CWE-1390 CVE-2025-59249: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-70571 [HIGH] CWE-121 CVE-2026-70571: Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVE-2026-69641 [CRITICAL] CWE-862 CVE-2026-69641: Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileg Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-55007 [HIGH] CWE-415 CVE-2026-55007: Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a netw Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVE-2026-69380 [HIGH] CWE-862 CVE-2026-69380: Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileg Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-45583 [HIGH] CWE-94 CVE-2026-45583: Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an una Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

CVE-2026-62911 [HIGH] CWE-294 CVE-2026-62911: Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker t Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2025-64666 [HIGH] CWE-20 CVE-2025-64666: Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate priv Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-87696 [HIGH] CWE-347 CVE-2026-87696: Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized a Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVE-2026-70279 [CRITICAL] CWE-79 CVE-2026-70279: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-55009 [HIGH] CWE-502 CVE-2026-55009: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elev Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.