Summary
Ein entfernter Angreifer kann mehrere Schwachstellen in Microsoft Exchange Server Subscription Edition RTM ausnutzen, um erweiterte Rechte – einschließlich Administratorrechte – zu erlangen, beliebigen Code auszuführen, einen Denial-of-Service-Zustand auszulösen oder Spoofing-Angriffe durchzuführen.
Product
Exchange ist ein Groupware und Nachrichtensystem der Firma Microsoft.
Vulnerabilities 9
-
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
-
High 7.5
Microsoft Exchange Server Denial of Service Vulnerability
Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
-
High 7.2
Microsoft Exchange Server Elevation of Privilege Vulnerability
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.2
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.1
Microsoft Exchange Server Spoofing Vulnerability
Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
-
Medium 6.5
Microsoft Exchange Server Spoofing Vulnerability
Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
Revision history
-
#1
Initiale Fassung
References
-
Microsoft Leitfaden für Sicherheitsupdates
https://msrc.microsoft.com/update-guide/
-
Microsoft Security Advisory CVE-2026-118153
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118153
-
Microsoft Security Advisory CVE-2026-118157
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118157
-
Microsoft Security Advisory CVE-2026-118149
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118149
-
Microsoft Security Advisory CVE-2026-118150
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118150
-
Microsoft Security Advisory CVE-2026-118151
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118151
-
Microsoft Security Advisory CVE-2026-118152
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118152
-
Microsoft Security Advisory CVE-2026-118154
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118154
-
Microsoft Security Advisory CVE-2026-118207
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118207
-
Microsoft Security Advisory CVE-2026-118208
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118208