ES
Email
Exchange Server
On CISA KEVExploited in the wildRansomware-linked
258
CVEs
20
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 23High 92Medium 66Low 0
Watch
Add Exchange Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-35368 | 8.8 | Aug 8 | Microsoft Exchange Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-32031 | 8.8 | Jun 14 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-21707 | 8.8 | Feb 14 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019; 2019 |
| CVE-2023-21706 | 8.8 | Feb 14 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2019; 2019 |
| CVE-2022-23277 | 8.8 | Mar 9 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2021-28482 | 8.8 | Apr 13 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2020-17143 | 8.8 | Dec 10 | Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2018-0986 | 8.8 | Apr 4 | A remote code execution vulnerability exists when the Microsoft Malware Protection Engine does not properly scan a specially crafted file, leading to memory corruption, aka… Affected: 2013; 2016 |
| CVE-2018-16793 | 8.6 | Sep 21 | Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access)… Affected: 2010; 2010; 2010; 2010; 2010; 2010; +12 more |
| CVE-2020-17084 | 8.5 | Nov 11 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2020-17141 | 8.4 | Dec 10 | Microsoft Exchange Remote Code Execution Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2020-16875 | 8.4 | Sep 11 | <p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p> <p>An attacker who successfully exploited the… Affected: 2016; 2016; 2019; 2019 |
| CVE-2022-21978 | 8.2 | May 10 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2026-69380 | 8.1 | Sep 8 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2026-55007 | 8.1 | Sep 8 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2019; 2019 |
| CVE-2026-45583 | 8.1 | Jun 9 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2020-0692 | 8.1 | Feb 11 | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability' Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2019-1136 | 8.1 | Jul 15 | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability' Affected: 2010; 2013; 2013; 2013 |
| CVE-2019-0724 | 8.1 | Mar 5 | An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability' Affected: 2010; 2013; 2016; 2019 |
| CVE-2017-11932 | 8.1 | Dec 12 | Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web requests, aka… Affected: 2016; 2016 |
| CVE-2026-62911 | 8.0 | Aug 11 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more |
| CVE-2025-53786 | 8.0 | Aug 6 | On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix Affected: 2016; 2019; 2019 |
| CVE-2023-36439 | 8.0 | Nov 14 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-36050 | 8.0 | Nov 14 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-36039 | 8.0 | Nov 14 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-36035 | 8.0 | Nov 14 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-36778 | 8.0 | Oct 10 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-36757 | 8.0 | Sep 12 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-36756 | 8.0 | Sep 12 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-36745 | 8.0 | Sep 12 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-36744 | 8.0 | Sep 12 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-38182 | 8.0 | Aug 8 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-35388 | 8.0 | Aug 8 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-28310 | 8.0 | Jun 14 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-21762 | 8.0 | Jan 10 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2013; 2016; 2019; 2019 |
| CVE-2023-21745 | 8.0 | Jan 10 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2022-41079 | 8.0 | Nov 9 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2022-41078 | 8.0 | Nov 9 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2022-24516 | 8.0 | Aug 9 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2022-24477 | 8.0 | Aug 9 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2022-21980 | 8.0 | Aug 9 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2021-41348 | 8.0 | Oct 13 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2021-34470 | 8.0 | Jul 14 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2013; 2016; 2019 |
| CVE-2021-33768 | 8.0 | Jul 14 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2026-87695 | 7.8 | Oct 13 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2026-55009 | 7.8 | Jul 14 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2026-55006 | 7.8 | Jul 14 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2025-53782 | 7.8 | Oct 14 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more |
| CVE-2023-21764 | 7.8 | Jan 10 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-21763 | 7.8 | Jan 10 | Microsoft Exchange Server Elevation of Privilege Vulnerability Affected: 2016; 2019; 2019 |