CVE-20XX-?
agent?

Microsoft Exchange Server CVEs.

Published CVEs affecting Microsoft Exchange Server, ranked by exploit odds.

55 CVEs · updated 2026-11-13 10:05 UTC

Reset all
  1. CVE-2022-41082

    Microsoft Exchange Server Remote Code Execution Vulnerability

    exploited Code execution Server Microsoft Exchange Server

    8.0 HIGH 100% exploit odds Fix listed
  2. CVE-2021-31207

    Microsoft Exchange Server Security Feature Bypass Vulnerability

    exploited Code execution Server Microsoft Exchange Server

    6.6 MEDIUM 100% exploit odds Fix listed
  3. CVE-2021-26857

    Microsoft Exchange Server Remote Code Execution Vulnerability

    exploited Code execution Server Microsoft Exchange Server

    7.8 HIGH 96% exploit odds Fix listed
  4. CVE-2021-26858

    Microsoft Exchange Server Remote Code Execution Vulnerability

    exploited Code execution Server Microsoft Exchange Server

    7.8 HIGH 94% exploit odds Fix listed
  5. CVE-2021-42321

    Microsoft Exchange Server Remote Code Execution Vulnerability

    exploited Code execution Server Microsoft Exchange Server

    8.8 HIGH 92% exploit odds Fix listed
  6. CVE-2020-17132

    Microsoft Exchange Remote Code Execution Vulnerability

    Drop everything Code execution Server Microsoft Exchange Server

    9.1 CRITICAL 90% exploit odds Fix listed
  7. CVE-2023-36035

    Microsoft Exchange Server Spoofing Vulnerability

    Code execution Server Microsoft Exchange Server

    8.0 HIGH 87% exploit odds Fix listed
  8. CVE-2021-28482

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.8 HIGH 83% exploit odds Fix listed
  9. CVE-2023-32031

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.8 HIGH 81% exploit odds Fix listed
  10. CVE-2023-21707

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.8 HIGH 80% exploit odds Fix listed
  11. CVE-2006-0027

    Unspecified vulnerability in Microsoft Exchange allows remote attackers to execute arbitrary code via e-mail messages with crafted (1) vCal or (2) iCal Calendar properties.

    Code execution Server Microsoft Exchange Server

    7.5 HIGH 78% exploit odds Fix listed
  12. CVE-2023-36745

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.0 HIGH 76% exploit odds Fix listed
  13. CVE-2021-31195

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    6.5 MEDIUM 74% exploit odds Fix listed
  14. CVE-2023-36039

    Microsoft Exchange Server Spoofing Vulnerability

    Code execution Server Microsoft Exchange Server

    8.0 HIGH 73% exploit odds Fix listed
  15. CVE-2021-28480

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Drop everything Code execution Server Microsoft Exchange Server

    9.8 CRITICAL 71% exploit odds Fix listed
  16. CVE-2007-0213

    Microsoft Exchange Server 2000 SP3, 2003 SP1 and SP2, and 2007 does not properly decode certain MIME encoded e-mails, which allows remote attackers to execute arbitrary code via a crafted base64-encoded MIME e-mail message.

    Drop everything Code execution Server Microsoft Exchange Server

    10.0 HIGH 68% exploit odds Fix listed
  17. CVE-2023-21529

    Microsoft Exchange Server Remote Code Execution Vulnerability

    exploited Code execution Server Microsoft Exchange Server

    8.8 HIGH 59% exploit odds Fix listed
  18. CVE-2023-36744

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.0 HIGH 57% exploit odds Fix listed
  19. CVE-2021-31196

    Microsoft Exchange Server Remote Code Execution Vulnerability

    exploited Code execution Server Microsoft Exchange Server

    7.2 HIGH 54% exploit odds Fix listed
  20. CVE-2023-36777

    Microsoft Exchange Server Information Disclosure Vulnerability

    Code execution Server Microsoft Exchange Server

    5.7 MEDIUM 52% exploit odds Fix listed
  21. CVE-2023-36756

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.0 HIGH 49% exploit odds Fix listed
  22. CVE-2020-17117

    Microsoft Exchange Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    6.6 MEDIUM 49% exploit odds Fix listed
  23. CVE-2020-16875

    <p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p> <p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.</p>

    Code execution Server Microsoft Exchange Server

    8.4 HIGH 46% exploit odds Fix listed
  24. CVE-2006-0002

    Unspecified vulnerability in Microsoft Outlook 2000 through 2003, Exchange 5.0 Server SP2 and 5.5 SP4, Exchange 2000 SP3, and Office allows remote attackers to execute arbitrary code via an e-mail message with a crafted Transport Neutral Encapsulation Format (TNEF) MIME attachment, related to message length validation.

    Code execution Server Microsoft Exchange Server

    7.5 HIGH 46% exploit odds Fix listed
  25. CVE-2022-23277

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.8 HIGH 41% exploit odds No fix listed
  26. CVE-2023-36050

    Microsoft Exchange Server Spoofing Vulnerability

    Code execution Server Microsoft Exchange Server

    8.0 HIGH 39% exploit odds Fix listed
  27. CVE-2023-36757

    Microsoft Exchange Server Spoofing Vulnerability

    Code execution Server Microsoft Exchange Server

    8.0 HIGH 37% exploit odds Fix listed
  28. CVE-2020-17144

    Microsoft Exchange Remote Code Execution Vulnerability

    exploited Code execution Server Microsoft Exchange Server

    8.4 HIGH 37% exploit odds Fix listed
  29. CVE-2021-28481

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    9.8 CRITICAL 36% exploit odds Fix listed
  30. CVE-2005-0044

    The OLE component in Windows 98, 2000, XP, and Server 2003, and Exchange Server 5.0 through 2003, does not properly validate the lengths of messages for certain OLE data, which allows remote attackers to execute arbitrary code, aka the "Input Validation Vulnerability."

    Code execution Server Microsoft Exchange Server

    7.5 HIGH 33% exploit odds Fix listed
  31. CVE-2004-0840

    The SMTP (Simple Mail Transfer Protocol) component of Microsoft Windows XP 64-bit Edition, Windows Server 2003, Windows Server 2003 64-bit Edition, and the Exchange Routing Engine component of Exchange Server 2003, allows remote attackers to execute arbitrary code via a malicious DNS response message containing length values that are not properly validated.

    Code execution OS & kernel Microsoft Exchange Server

    10.0 HIGH 30% exploit odds Fix listed
  32. CVE-2021-26412

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    9.1 CRITICAL 29% exploit odds Fix listed
  33. CVE-2023-28310

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.0 HIGH 25% exploit odds Fix listed
  34. CVE-2009-0098

    Microsoft Exchange 2000 Server SP3, Exchange Server 2003 SP2, and Exchange Server 2007 SP1 do not properly interpret Transport Neutral Encapsulation (TNEF) properties, which allows remote attackers to execute arbitrary code via a crafted TNEF message, aka "Memory Corruption Vulnerability."

    Code execution Server Microsoft Exchange Server

    9.3 HIGH 25% exploit odds No fix listed
  35. CVE-2019-1373

    A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.

    Code execution Server Microsoft Exchange Server

    9.8 CRITICAL 22% exploit odds Fix listed
  36. CVE-2021-26854

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    6.6 MEDIUM 21% exploit odds Fix listed
  37. CVE-2018-8265

    A remote code execution vulnerability exists in the way Microsoft Exchange software parses specially crafted email messages, aka "Microsoft Exchange Remote Code Execution Vulnerability." This affects Microsoft Exchange Server.

    Code execution Server Microsoft Exchange Server

    7.8 HIGH 19% exploit odds Fix listed
  38. CVE-2021-27078

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    9.1 CRITICAL 18% exploit odds Fix listed
  39. CVE-2021-31206

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    7.6 HIGH 13% exploit odds Fix listed
  40. CVE-2023-38181

    Microsoft Exchange Server Spoofing Vulnerability

    Code execution Server Microsoft Exchange Server

    8.8 HIGH 11% exploit odds Fix listed
  41. CVE-2023-21710

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    7.2 HIGH 8% exploit odds Fix listed
  42. CVE-2023-35388

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.0 HIGH 7% exploit odds Fix listed
  43. CVE-2024-26198

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.8 HIGH 7% exploit odds Fix listed
  44. CVE-2020-17141

    Microsoft Exchange Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.4 HIGH 7% exploit odds Fix listed
  45. CVE-2001-0340

    An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically.

    Code execution Browser & mail Microsoft Exchange Server

    7.5 HIGH 6% exploit odds Fix listed
  46. CVE-2023-38182

    Microsoft Exchange Server Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    8.0 HIGH 6% exploit odds Fix listed
  47. CVE-2020-17142

    Microsoft Exchange Remote Code Execution Vulnerability

    Code execution Server Microsoft Exchange Server

    9.1 CRITICAL 3% exploit odds Fix listed
  48. CVE-2026-55009

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

    Code execution Server Microsoft Exchange Server

    7.8 HIGH 3% exploit odds Fix listed
  49. CVE-2026-87692

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

    Code execution Server Microsoft Exchange Server

    7.8 HIGH 2% exploit odds Fix listed
  50. CVE-2026-62912

    Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.

    Code execution Server Microsoft Exchange Server

    6.5 MEDIUM 2% exploit odds Fix listed

All CVEs affecting Microsoft Exchange Server that appear in CVE.org and NVD, sorted by how likely they are to be exploited (EPSS), with fix status and timeline.