Microsoft Exchange Server Subscription Edition vulnerabilities
🔔 Create alert RSS Version checker
Published CVEs affecting Microsoft Exchange Server Subscription Edition: 35 record(s), with affected versions and fixes.cpe:2.3:a:microsoft:exchange_server_subscription_edition
CVE-2026-96940
High · 8.8
CWE-1390 Oct 2, 2026
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate...
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-69641
Critical · 9.1
CWE-862 Sep 8, 2026
Microsoft Exchange Server Elevation of Privilege Vulnerability
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-69382
Medium · 5.9
CWE-327 Sep 8, 2026
Microsoft Exchange Server Information Disclosure Vulnerability
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
CVE-2026-69380
High · 8.1
CWE-862 Sep 8, 2026
Microsoft Exchange Server Elevation of Privilege Vulnerability
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-69378
High · 7.5
CWE-674 Sep 8, 2026
Microsoft Exchange Server Denial of Service Vulnerability
Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
CVE-2026-69375
Medium · 6.5
CWE-639 Sep 8, 2026
Microsoft Exchange Server Tampering Vulnerability
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
CVE-2026-69361
Medium · 6.5
CWE-918 Sep 8, 2026
Microsoft Exchange Server Spoofing Vulnerability
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
CVE-2026-69356
Critical · 9.3
CWE-79 Sep 8, 2026
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-69355
High · 8.8
CWE-73 Sep 8, 2026
Microsoft Exchange Server Remote Code Execution Vulnerability
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVE-2026-55007
High · 8.1
CWE-415 Sep 8, 2026
Microsoft Exchange Server Remote Code Execution Vulnerability
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
CVE-2026-65813
High · 8.8
CWE-918 Aug 11, 2026
Microsoft Exchange Server Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-62915
Medium · 6.5
CWE-862 Aug 11, 2026
Microsoft Exchange Server Security Feature Bypass Vulnerability
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.
CVE-2026-62914
Medium · 5.4
CWE-79 Aug 11, 2026
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
CVE-2026-62913
High · 8.8
CWE-122 Aug 11, 2026
Microsoft Exchange Server Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVE-2026-62912
Medium · 6.5
CWE-502 Aug 11, 2026
Microsoft Exchange Server Denial of Service Vulnerability
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
CVE-2026-62911
High · 8.0
CWE-294 Aug 11, 2026
Microsoft Exchange Server Elevation of Privilege Vulnerability
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-62910
High · 8.8
CWE-99 Aug 11, 2026
Microsoft Exchange Server Elevation of Privilege Vulnerability
Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-55009
High · 7.8
CWE-502 Jul 14, 2026
Microsoft Exchange Server Elevation of Privilege Vulnerability
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-55008
Critical · 9.6
CWE-79 Jul 14, 2026
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-55006
High · 7.8
CWE-1220 Jul 14, 2026
Microsoft Exchange Server Elevation of Privilege Vulnerability
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVE-2026-55005
High · 8.8
CWE-122 Jul 14, 2026
Microsoft Exchange Server Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVE-2026-47631
Medium · 5.4
CWE-79 Jun 9, 2026
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-45583
High · 8.1
CWE-94 Jun 9, 2026
Microsoft Exchange Server Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
CVE-2026-45504
High · 8.8
CWE-918 Jun 9, 2026
Microsoft Exchange Server Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVE-2026-45503
Medium · 6.5
CWE-918 Jun 9, 2026
Microsoft Exchange Server Information Disclosure Vulnerability
Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.