Exchange Server vulnerabilities
26 known vulnerabilities in Exchange Server from Microsoft. 24 are rated high or critical, and 20 have been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.
Latest first
- 9.3 Critical severity
Microsoft Exchange Server 2016 Cumulative…: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- 8.8 High severity
Microsoft Exchange Server 2016 Cumulative…: Improper Control of Resource Identifiers
Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- 9.6 Critical severity
Microsoft Exchange Server 2016 Cumulative…: Improper Neutralization of Input During Web Page Generation
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- 8.1 High severity
Microsoft Exchange Server 2016 Cumulative…: Improper Control of Generation of Code
Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
- 6.1 Medium severity
Microsoft Exchange Server Cross-Site Scripting Exploited
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- 7.5 High severity
Microsoft Exchange Server 2016 Cumulative…: Exposure of Sensitive Information to an Unauthorized Actor
Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
- 8.0 High severity
Microsoft Exchange Server 2016 Cumulative…: Improper Authentication
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following furt
- 9.8 Critical severity
Microsoft Exchange Server Privilege Escalation Exploited
Microsoft Exchange Server Elevation of Privilege Vulnerability
- 8.8 High severity
Microsoft Exchange Server Deserialization of Untrusted Data Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 9.8 Critical severity
Microsoft Exchange Server Privilege Escalation Exploited
Microsoft Exchange Server Elevation of Privilege Vulnerability
- 8.0 High severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 8.8 High severity
Microsoft Exchange Server Server-Side Request Forgery Exploited
Microsoft Exchange Server Elevation of Privilege Vulnerability
- 8.8 High severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 9.8 Critical severity
Microsoft Exchange Server Privilege Escalation Exploited
Microsoft Exchange Server Elevation of Privilege Vulnerability
- 9.8 Critical severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 7.5 High severity
Microsoft Exchange Server Information Disclosure Exploited
Microsoft Exchange Server Information Disclosure Vulnerability
- 7.2 High severity
Microsoft Exchange Server Information Disclosure Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 6.6 Medium severity
Microsoft Exchange Server Security Feature Bypass Exploited
Microsoft Exchange Server Security Feature Bypass Vulnerability
- 7.8 High severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 7.8 High severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 9.8 Critical severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Server Remote Code Execution Vulnerability
- 8.8 High severity
Microsoft Exchange Server Remote Code Execution Exploited
Microsoft Exchange Remote Code Execution Vulnerability
- 8.8 High severity
Microsoft Exchange Server Validation Key Remote Code Execution Exploited
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.
- 7.4 High severity
Microsoft Exchange Server Privilege Escalation Exploited
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
- 7.8 High severity
Microsoft Malware Protection Engine Improper Restriction of Operations Exploited
The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, a