Microsoft Exchange Server Subscription Edition Rtm vulnerabilities

CVE-2026-87692 [HIGH] CWE-502 CVE-2026-87692: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elev Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

CVE-2025-53786 [HIGH] CWE-287 CVE-2025-53786: On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance an

CVE-2026-55008 [CRITICAL] CWE-79 CVE-2026-55008: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-69356 [CRITICAL] CWE-79 CVE-2026-69356: Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Ex Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2026-55006 [HIGH] CWE-1220 CVE-2026-55006: Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacke Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

CVE-2026-69378 [HIGH] CWE-674 CVE-2026-69378: Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.

CVE-2026-87695 [HIGH] CWE-829 CVE-2026-87695: Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an auth Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

CVE-2025-59248 [HIGH] CWE-20 CVE-2025-59248: Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform sp Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVE-2025-53782 [HIGH] CWE-303 CVE-2025-53782: Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthor Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.

CVE-2026-45502 [MEDIUM] CWE-918 CVE-2026-45502: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to dis Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

CVE-2025-33051 [HIGH] CWE-200 CVE-2025-33051: Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an un Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

CVE-2026-62912 [MEDIUM] CWE-502 CVE-2026-62912: Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.

CVE-2026-69361 [MEDIUM] CWE-918 CVE-2026-69361: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to per Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

CVE-2026-69375 [MEDIUM] CWE-639 CVE-2026-69375: Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized a Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

CVE-2026-62915 [MEDIUM] CWE-862 CVE-2026-62915: Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a securit Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.

CVE-2025-25005 [MEDIUM] CWE-20 CVE-2025-25005: Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tamp Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

CVE-2026-45503 [MEDIUM] CWE-285 CVE-2026-45503: Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose inform Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

CVE-2026-69382 [MEDIUM] CWE-327 CVE-2026-69382: Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

CVE-2026-45501 [MEDIUM] CWE-918 CVE-2026-45501: Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to per Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

CVE-2025-25007 [MEDIUM] CWE-1286 CVE-2025-25007: Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unautho Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.