CVE-20XX-?

Microsoft Exchange Server CVEs.

Published CVEs affecting Microsoft Exchange Server, ranked by exploit odds.

43 CVEs · updated 2026-11-06 03:49 UTC

  1. CVE-2026-42897

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    exploited XSS Server Microsoft Exchange Server

    8.1 HIGH 71% exploit odds Fix listed
  2. CVE-2026-45502

    Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

    Disclosure Server Microsoft Exchange Server

    5.0 MEDIUM 20% exploit odds Fix listed
  3. CVE-2026-21527

    User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    Other Server Microsoft Exchange Server

    6.5 MEDIUM 8% exploit odds Fix listed
  4. CVE-2025-53786

    On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.

    Microsoft Exchange Server

    8.0 HIGH 8% exploit odds Fix listed
  5. CVE-2026-96940

    Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Other Server Microsoft Exchange Server

    8.8 HIGH 3% exploit odds Fix listed
  6. CVE-2026-55009

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

    Code execution Server Microsoft Exchange Server

    7.8 HIGH 3% exploit odds Fix listed
  7. CVE-2026-87692

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

    Code execution Server Microsoft Exchange Server

    7.8 HIGH 2% exploit odds Fix listed
  8. CVE-2026-62912

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.

    Code execution Server Microsoft Exchange Server

    6.5 MEDIUM 2% exploit odds Fix listed
  9. CVE-2025-25005

    Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

    Microsoft Exchange Server

    6.5 MEDIUM 1% exploit odds Fix listed
  10. CVE-2025-33051

    Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

    Microsoft Exchange Server

    7.5 HIGH 1% exploit odds Fix listed
  11. CVE-2026-45504

    Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Disclosure Server Microsoft Exchange Server

    8.8 HIGH 1% exploit odds Fix listed
  12. CVE-2026-69378

    Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.

    Denial of service Server Microsoft Exchange Server

    7.5 HIGH 1% exploit odds Fix listed
  13. CVE-2025-64666

    Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Other Server Microsoft Exchange Server

    7.5 HIGH 1% exploit odds Fix listed
  14. CVE-2025-59248

    Improper input validation in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    Other Server Microsoft Exchange Server

    7.5 HIGH 1% exploit odds Fix listed
  15. CVE-2026-55005

    Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

    Memory safety Server Microsoft Exchange Server

    8.8 HIGH 1% exploit odds Fix listed
  16. CVE-2026-62910

    Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Other Server Microsoft Exchange Server

    7.2 HIGH 1% exploit odds Fix listed
  17. CVE-2026-65813

    Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Disclosure Server Microsoft Exchange Server

    6.5 MEDIUM 0.9% exploit odds Fix listed
  18. CVE-2025-25006

    Improper handling of additional special element in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Exchange Server

    5.3 MEDIUM 0.9% exploit odds Fix listed
  19. CVE-2026-62913

    Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

    Memory safety Server Microsoft Exchange Server

    8.8 HIGH 0.9% exploit odds Fix listed
  20. CVE-2026-69355

    External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

    Other Server Microsoft Exchange Server

    8.8 HIGH 0.9% exploit odds Fix listed
  21. CVE-2025-25007

    Improper validation of syntactic correctness of input in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    Microsoft Exchange Server

    5.3 MEDIUM 0.9% exploit odds Fix listed
  22. CVE-2026-55008

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    XSS Server Microsoft Exchange Server

    9.6 CRITICAL 0.9% exploit odds Fix listed
  23. CVE-2026-69641

    Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Auth & access Server Microsoft Exchange Server

    9.1 CRITICAL 0.9% exploit odds Fix listed
  24. CVE-2025-59249

    Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Other Server Microsoft Exchange Server

    8.8 HIGH 0.8% exploit odds Fix listed
  25. CVE-2026-69361

    Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

    Disclosure Server Microsoft Exchange Server

    6.5 MEDIUM 0.8% exploit odds Fix listed
  26. CVE-2025-64667

    User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    Other Server Microsoft Exchange Server

    5.3 MEDIUM 0.8% exploit odds Fix listed
  27. CVE-2026-69356

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    XSS Server Microsoft Exchange Server

    9.3 CRITICAL 0.8% exploit odds Fix listed
  28. CVE-2026-55007

    Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

    Memory safety Server Microsoft Exchange Server

    8.1 HIGH 0.7% exploit odds Fix listed
  29. CVE-2026-62911

    Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Auth & access Server Microsoft Exchange Server

    8.0 HIGH 0.7% exploit odds Fix listed
  30. CVE-2026-69380

    Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Auth & access Server Microsoft Exchange Server

    8.1 HIGH 0.7% exploit odds Fix listed
  31. CVE-2026-62915

    Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.

    Auth & access Server Microsoft Exchange Server

    6.5 MEDIUM 0.6% exploit odds Fix listed
  32. CVE-2026-69375

    Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

    Auth & access Server Microsoft Exchange Server

    6.5 MEDIUM 0.6% exploit odds Fix listed
  33. CVE-2026-45583

    Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

    Injection Server Microsoft Exchange Server

    7.5 HIGH 0.5% exploit odds Fix listed
  34. CVE-2026-69382

    Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

    Crypto Server Microsoft Exchange Server

    5.9 MEDIUM 0.5% exploit odds Fix listed
  35. CVE-2026-62914

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

    XSS Server Microsoft Exchange Server

    7.3 HIGH 0.4% exploit odds Fix listed
  36. CVE-2026-45503

    Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

    Other Server Microsoft Exchange Server

    8.1 HIGH 0.4% exploit odds Fix listed
  37. CVE-2026-87696

    Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

    Crypto Server Microsoft Exchange Server

    7.5 HIGH 0.4% exploit odds Fix listed
  38. CVE-2026-45501

    Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

    Disclosure Server Microsoft Exchange Server

    6.5 MEDIUM 0.4% exploit odds Fix listed
  39. CVE-2026-45500

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    XSS Server Microsoft Exchange Server

    6.1 MEDIUM 0.4% exploit odds Fix listed
  40. CVE-2025-53782

    Incorrect implementation of authentication algorithm in Microsoft Exchange Server allows an unauthorized attacker to elevate privileges locally.

    Auth & access Server Microsoft Exchange Server

    8.4 HIGH 0.4% exploit odds Fix listed
  41. CVE-2026-47631

    Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

    XSS Server Microsoft Exchange Server

    8.1 HIGH 0.4% exploit odds Fix listed
  42. CVE-2026-55006

    Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

    Other Server Microsoft Exchange Server

    7.8 HIGH 0.3% exploit odds Fix listed
  43. CVE-2026-87695

    Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

    Other Server Microsoft Exchange Server

    7.8 HIGH 0.3% exploit odds Fix listed

All CVEs affecting Microsoft Exchange Server that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.