Microsoft Exchange Server Subscription Edition RTM at a glance
Show as table
| Month | Vulnerabilities | Critical |
|---|---|---|
| Nov 2026 | 9 | 0 |
| Oct 2026 | 7 | 1 |
| Sep 2026 | 9 | 2 |
| Aug 2026 | 7 | 0 |
| Jul 2026 | 4 | 1 |
| Jun 2026 | 7 | 0 |
| May 2026 | 1 | 0 |
| Apr 2026 | 0 | 0 |
| Mar 2026 | 0 | 0 |
| Feb 2026 | 1 | 0 |
| Jan 2026 | 0 | 0 |
| Dec 2025 | 2 | 0 |
| Nov 2025 | 0 | 0 |
| Oct 2025 | 3 | 0 |
| Sep 2025 | 0 | 0 |
| Aug 2025 | 5 | 0 |
| Jul 2025 | 0 | 0 |
| Jun 2025 | 0 | 0 |
| May 2025 | 0 | 0 |
| Apr 2025 | 0 | 0 |
| Mar 2025 | 0 | 0 |
| Feb 2025 | 0 | 0 |
| Jan 2025 | 0 | 0 |
| Dec 2024 | 0 | 0 |
Most common weaknesses
55 results · Feed
-
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
-
High 7.1
Microsoft Exchange Server Spoofing Vulnerability
Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
-
High 8.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.2
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
Medium 6.5
Microsoft Exchange Server Spoofing Vulnerability
Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
-
High 7.5
Microsoft Exchange Server Denial of Service Vulnerability
Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
-
High 8.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.2
Microsoft Exchange Server Elevation of Privilege Vulnerability
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
-
High 8.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
-
High 7.5
Microsoft Exchange Server Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 8.1
Microsoft Exchange Server Remote Code Execution Vulnerability
Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
-
Critical 9.3
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
-
High 8.8CVE-2026-96940 Public exploit
Microsoft Exchange Server Elevation of Privilege Vulnerability
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
Critical 9.1
Microsoft Exchange Server Elevation of Privilege Vulnerability
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
Medium 5.9
Microsoft Exchange Server Information Disclosure Vulnerability
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
-
High 8.1
Microsoft Exchange Server Elevation of Privilege Vulnerability
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
Medium 6.5
Microsoft Exchange Server Tampering Vulnerability
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
-
High 7.5
Microsoft Exchange Server Denial of Service Vulnerability
Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
-
Medium 6.5
Microsoft Exchange Server Spoofing Vulnerability
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
-
Critical 9.3
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
-
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
-
High 8.1
Microsoft Exchange Server Remote Code Execution Vulnerability
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
-
High 8.0CVE-2026-62911 Public exploit
Microsoft Exchange Server Elevation of Privilege Vulnerability
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
Medium 6.5
Microsoft Exchange Server Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.3
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
-
Medium 6.5
Microsoft Exchange Server Security Feature Bypass Vulnerability
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.
-
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
-
Medium 6.5
Microsoft Exchange Server Denial of Service Vulnerability
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.
-
High 7.2
Microsoft Exchange Server Elevation of Privilege Vulnerability
Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
-
High 7.8
Microsoft Exchange Server Elevation of Privilege Vulnerability
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
-
Critical 9.6
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
-
High 8.8
Microsoft Exchange Server Remote Code Execution Vulnerability
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
-
High 8.1
Microsoft Exchange Server Spoofing Vulnerability
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
-
High 8.8CVE-2026-45504 Public exploit
Microsoft Exchange Server Elevation of Privilege Vulnerability
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
-
High 7.5
Microsoft Exchange Server Remote Code Execution Vulnerability
Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
-
High 8.1
Microsoft Exchange Server Information Disclosure Vulnerability
Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.