ES
Email
Exchange Server
On CISA KEVExploited in the wildRansomware-linked
258
CVEs
20
On KEV
9.8
Max CVSS
3
New 30D
Severity mix
Critical 23High 92Medium 66Low 0
Watch
Add Exchange Server to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2016-0031 | 6.1 | Jan 13 | Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted… Affected: 2016 |
| CVE-2016-0030 | 6.1 | Jan 13 | Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject… Affected: 2013; 2013; 2016 |
| CVE-2016-0029 | 6.1 | Jan 13 | Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted… Affected: 2016 |
| CVE-2026-69382 | 5.9 | Sep 8 | Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2023-36777 | 5.7 | Sep 12 | Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +29 more |
| CVE-2020-17083 | 5.5 | Nov 11 | Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2018-0941 | 5.5 | Mar 14 | Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how data is… Affected: 2016; 2016 |
| CVE-2017-8537 | 5.5 | May 26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… Affected: 2013; 2016 |
| CVE-2017-8536 | 5.5 | May 26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… Affected: 2013; 2016 |
| CVE-2017-8535 | 5.5 | May 26 | The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… Affected: 2013; 2016 |
| CVE-2026-62914 | 5.4 | Aug 11 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more |
| CVE-2026-47631 | 5.4 | Jun 9 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2021-1730 | 5.4 | Feb 25 | <p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p> <p>This update… Affected: 2016; 2019 |
| CVE-2020-0903 | 5.4 | Mar 12 | A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka… Affected: 2016; 2016; 2019; 2019 |
| CVE-2019-1137 | 5.4 | Jul 15 | A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka… Affected: 2013; 2013; 2013; 2013; 2013; 2013; +34 more |
| CVE-2019-0817 | 5.4 | Apr 9 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability' Affected: 2010; 2013; 2016; 2016; 2019; 2019 |
| CVE-2018-8448 | 5.4 | Oct 10 | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of… Affected: 2013; 2016 |
| CVE-2018-8159 | 5.4 | May 9 | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Elevation of… Affected: 2013; 2013; 2016; 2016 |
| CVE-2018-8153 | 5.4 | May 9 | A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Spoofing Vulnerability."… Affected: 2016; 2016 |
| CVE-2018-8152 | 5.4 | May 9 | An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka "Microsoft Exchange Server Elevation of… Affected: 2016; 2016 |
| CVE-2025-64667 | 5.3 | Dec 9 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more |
| CVE-2025-25007 | 5.3 | Aug 12 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more |
| CVE-2025-25006 | 5.3 | Aug 12 | Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +30 more |
| CVE-2022-34692 | 5.3 | Aug 9 | Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2016; 2019; 2019 |
| CVE-2017-11761 | 5.3 | Sep 13 | Microsoft Exchange Server 2013 and Microsoft Exchange Server 2016 allow an input sanitization issue with Microsoft Exchange that could potentially result in unintended Information… Affected: 2013; 2013; 2013; 2016; 2016 |
| CVE-2026-45502 | 5.0 | Jun 9 | Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2019; 2019 |
| CVE-2022-21979 | 4.8 | Aug 9 | Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2013; 2016; 2016; 2019; 2019 |
| CVE-2018-8604 | 4.3 | Dec 12 | A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability." This affects… Affected: 2016; 2016 |
| CVE-2018-8374 | 4.3 | Aug 15 | A tampering vulnerability exists when Microsoft Exchange Server fails to properly handle profile data, aka "Microsoft Exchange Server Tampering Vulnerability." This affects… Affected: 2016 Cumulative Update 10; 2016 Cumulative Update 9 |
| CVE-2018-8151 | 4.3 | May 9 | An information disclosure vulnerability exists when Microsoft Exchange improperly handles objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects… Affected: 2010; 2013; 2013; 2013; 2016; 2016 |
| CVE-2016-0138 | 4.3 | Sep 14 | Microsoft Exchange Server 2007 SP3, 2010 SP3, 2013 SP1, 2013 Cumulative Update 12, 2013 Cumulative Update 13, 2016 Cumulative Update 1, and 2016 Cumulative Update 2 misparses… Affected: 2007; 2010; 2013; 2013; 2013; 2016; +1 more |
| CVE-2015-2544 | – | Sep 9 | Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to inject… Affected: 2013; 2013; 2013 |
| CVE-2015-2543 | – | Sep 9 | Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 allows remote attackers to inject arbitrary web… Affected: 2013; 2013 |
| CVE-2015-2505 | – | Sep 9 | Outlook Web Access (OWA) in Microsoft Exchange Server 2013 Cumulative Update 8 and 9 and SP1 allows remote attackers to obtain sensitive stacktrace information via a crafted… Affected: 2013; 2013; 2013 |
| CVE-2015-2359 | – | Jun 10 | Cross-site scripting (XSS) vulnerability in the web applications in Microsoft Exchange Server 2013 Cumulative Update 8 allows remote attackers to inject arbitrary web script or… Affected: 2013; 2013 |
| CVE-2015-1771 | – | Jun 10 | Cross-site request forgery (CSRF) vulnerability in the web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allows remote attackers to hijack the… Affected: 2013; 2013 |
| CVE-2015-1764 | – | Jun 10 | The web applications in Microsoft Exchange Server 2013 SP1 and Cumulative Update 8 allow remote attackers to bypass the Same Origin Policy and send HTTP traffic to intranet… Affected: 2013; 2013 |
| CVE-2015-1632 | – | Mar 11 | Cross-site scripting (XSS) vulnerability in errorfe.aspx in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject… Affected: 2013; 2013 |
| CVE-2015-1631 | – | Mar 11 | Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to spoof meeting organizers via unspecified vectors, aka "Exchange Forged Meeting Request… Affected: 2013; 2013 |
| CVE-2015-1630 | – | Mar 11 | Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web… Affected: 2013; 2013 |
| CVE-2015-1629 | – | Mar 11 | Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web… Affected: 2013; 2013 |
| CVE-2015-1628 | – | Mar 11 | Cross-site scripting (XSS) vulnerability in Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 7 allows remote attackers to inject arbitrary web… Affected: 2013; 2013 |
| CVE-2014-6336 | – | Dec 11 | Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which allows remote attackers to redirect users… Affected: 2013; 2013 |
| CVE-2014-6326 | – | Dec 11 | Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted… Affected: 2013; 2013 |
| CVE-2014-6325 | – | Dec 11 | Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted… Affected: 2013; 2013 |
| CVE-2014-6319 | – | Dec 11 | Outlook Web App (OWA) in Microsoft Exchange Server 2007 SP3, 2010 SP3, and 2013 SP1 and Cumulative Update 6 does not properly validate tokens in requests, which allows remote… Affected: 2007; 2010; 2013; 2013 |
| CVE-2013-5072 | – | Dec 11 | Cross-site scripting (XSS) vulnerability in Outlook Web Access in Microsoft Exchange Server 2010 SP2 and SP3 and 2013 Cumulative Update 2 and 3 allows remote attackers to inject… Affected: 2010; 2010; 2013; 2013 |
| CVE-2013-0418 | – | Jan 17 | Unspecified vulnerability in the Oracle Outside In Technology component in Oracle Fusion Middleware 8.3.7 and 8.4 allows context-dependent attackers to affect availability via… Affected: 2007; 2010 |
| CVE-2012-4791 | – | Dec 12 | Microsoft Exchange Server 2007 SP3 and 2010 SP1 and SP2 allows remote authenticated users to cause a denial of service (Information Store service hang) by subscribing to a crafted… Affected: 2007; 2010; 2010 |
| CVE-2010-3937 | – | Dec 16 | Microsoft Exchange Server 2007 SP2 on the x64 platform allows remote authenticated users to cause a denial of service (infinite loop and MSExchangeIS outage) via a crafted RPC… Affected: 2007 |