ES
Email
Exchange Server
On CISA KEVExploited in the wildRansomware-linked
258
CVEs
20
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 23High 92Medium 66Low 0
Watch
Add Exchange Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2019-0817 | 5.4 | Apr 9 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability' Affected: 2010; 2013; 2016; 2016; 2019; 2019 |
| CVE-2018-8448 | 5.4 | Oct 10 | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of… Affected: 2013; 2016 |
| CVE-2018-8159 | 5.4 | May 9 | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Elevation of… Affected: 2013; 2013; 2016; 2016 |
| CVE-2018-8153 | 5.4 | May 9 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Spoofing Vulnerability."… Affected: 2016; 2016 |
| CVE-2018-8152 | 5.4 | May 9 | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of… Affected: 2016; 2016 |
| CVE-2025-64667 | 5.3 | Dec 9 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more |
| CVE-2025-25007 | 5.3 | Aug 12 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more |
| CVE-2025-25006 | 5.3 | Aug 12 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +30 more |
| CVE-2022-34692 | 5.3 | Aug 9 | Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2017-11761 | 5.3 | Sep 13 | Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potentially result in unintended Information… Affected: 2013; 2013; 2013; 2016; 2016 |
| CVE-2026-45502 | 5.0 | Jun 9 | Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2022-21979 | 4.8 | Aug 9 | Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2018-8604 | 4.3 | Dec 12 | A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability." This affects… Affected: 2016; 2016 |
| CVE-2018-8374 | 4.3 | Aug 15 | A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability." This affects… Affected: 2016 Cumulative Update 10; 2016 Cumulative Update 9 |
| CVE-2018-8151 | 4.3 | May 9 | An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects… Affected: 2010; 2013; 2013; 2013; 2016; 2016 |
| CVE-2016-0138 | 4.3 | Sep 14 | Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses… Affected: 2007; 2010; 2013; 2013; 2013; 2016; +1 more |