High WID-SEC-2026-1846 7 CVEs

Microsoft Exchange: Mehrere Schwachstellen

Published Jun 9, 2026 · Updated Jun 24, 2026 · Revision 2 · de-DE

Vendor: Microsoft Product: Exchange Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Microsoft Exchange ausnutzen, um Administratorrechte zu erlangen, beliebigen Code auszuführen, Spoofing-Angriffe durchzuführen, vertrauliche Informationen offenzulegen und Daten zu manipulieren.

Product

Exchange ist ein Groupware und Nachrichtensystem der Firma Microsoft.

Vulnerabilities 7

High 8.8

CVE-2026-45504 Public exploit

Microsoft Exchange Server Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server Subscription Edition RTM Microsoft Exchange Server 2019 Cumulative Update 14

Jun 9, 2026
High 8.1

CVE-2026-45503

Microsoft Exchange Server Information Disclosure Vulnerability

Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server Subscription Edition RTM Microsoft Exchange Server 2019 Cumulative Update 14

Jun 9, 2026
High 8.1

CVE-2026-47631

Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server Subscription Edition RTM Microsoft Exchange Server 2019 Cumulative Update 14

Jun 9, 2026
High 7.5

CVE-2026-45583

Microsoft Exchange Server Remote Code Execution Vulnerability

Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server Subscription Edition RTM Microsoft Exchange Server 2019 Cumulative Update 14

Jun 9, 2026
Medium 6.5

CVE-2026-45501

Microsoft Exchange Server Spoofing Vulnerability

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server Subscription Edition RTM Microsoft Exchange Server 2019 Cumulative Update 14

Jun 9, 2026
Medium 6.1

CVE-2026-45500

Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server Subscription Edition RTM Microsoft Exchange Server 2019 Cumulative Update 14

Jun 9, 2026
Medium 5.0

CVE-2026-45502 EPSS 20%

Microsoft Exchange Server Information Disclosure Vulnerability

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server Subscription Edition RTM Microsoft Exchange Server 2019 Cumulative Update 14

Jun 9, 2026

Revision history

2026-06-24 #2
PoC für CVE-2026-45504 aufgenommen
2026-06-09 #1
Initiale Fassung

References

Microsoft Leitfaden für Sicherheitsupdates
https://msrc.microsoft.com/update-guide/
Hawktrace Blog vom 2026-06-24
https://hawktrace.com/blog/CVE-2026-45504/
Microsoft CVE-2026-45500
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45500
Microsoft CVE-2026-45501
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45501
Microsoft CVE-2026-45502
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45502
Microsoft CVE-2026-45503
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45503
Microsoft CVE-2026-45504
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45504
Microsoft CVE-2026-45583
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45583
Microsoft CVE-2026-47631
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-47631