Exchange Server vulnerabilities | LiveThreat CVE Feed

Exchange Server

by Microsoft · last CVE Oct 13, 2026

On CISA KEVExploited in the wildRansomware-linked

258

CVEs

On KEV

9.8

Max CVSS

New 30D

Vulnerabilities258 In the news12 Timeline

Severity mix

Critical 23High 92Medium 66Low 0

Severity

All severities258 Critical23 High92 Medium66 Low0

Exploitation

On CISA KEV20 Exploited in the wild20

Watch

Add Exchange Server to your stack to get only the CVEs that touch what you run.

CVE	CVSS	EPSS	Published	Summary · affected versions
CVE-2021-31207 RansomwareIn wildKEV	6.6	100%	May 11	Microsoft Exchange Server Security Feature Bypass Vulnerability Affected: 15.01.0 before 15.01.2176.014
CVE-2026-42897 In wildKEV	6.1	71%	May 14	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +33 more
CVE-2021-26854	6.6	25%	Mar 3	Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2020-17117	6.6	49%	Dec 10	Microsoft Exchange Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2026-69375	6.5	1%	Sep 8	Microsoft Exchange Server Tampering Vulnerability Affected: 2016; 2019; 2019
CVE-2026-69361	6.5	1%	Sep 8	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019
CVE-2026-62915	6.5	1%	Aug 11	Microsoft Exchange Server Security Feature Bypass Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more
CVE-2026-62912	6.5	2%	Aug 11	Microsoft Exchange Server Denial of Service Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more
CVE-2026-45503	6.5	0%	Jun 9	Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2019; 2019
CVE-2026-21527	6.5	8%	Feb 10	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019
CVE-2025-25005	6.5	1%	Aug 12	Improper input validation in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more
CVE-2022-30134	6.5	2%	Aug 9	Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2022-24463	6.5	32%	Mar 9	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2019; 2019
CVE-2021-42305	6.5	8%	Nov 10	Microsoft Exchange Server Spoofing Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2021-41349	6.5	93%	Nov 10	Microsoft Exchange Server Spoofing Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2021-41350	6.5	2%	Oct 13	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2019; 2019
CVE-2021-31209	6.5	3%	May 11	Microsoft Exchange Server Spoofing Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2021-31195	6.5	74%	May 11	Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2021-24085	6.5	5%	Feb 25	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2019; 2019
CVE-2019-1084	6.5	5%	Jul 15	An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters Affected: 2010; 2013; 2016; 2016; 2016; 2016
CVE-2019-0588	6.5	5%	Jan 8	An information disclosure vulnerability exists when the Microsoft Exchange PowerShell API grants calendar contributors more view permissions than intended, aka "Microsoft Exchange… Affected: 2010; 2013; 2016; 2016; 2019
CVE-2018-0940	6.5	7%	Mar 14	Microsoft Exchange Outlook Web Access (OWA) in Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft… Affected: 2010; 2013; 2013; 2013; 2016; 2016
CVE-2018-0924	6.5	8%	Mar 14	Microsoft Exchange Server 2010 Service Pack 3 Update Rollup 20, Microsoft Exchange Server 2013 Cumulative Update 18, Microsoft Exchange Server 2013 Cumulative Update 19, Microsoft… Affected: 2010; 2013; 2013; 2013; 2016; 2016
CVE-2020-17085	6.2	4%	Nov 11	Microsoft Exchange Server Denial of Service Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2026-45501	6.1	0%	Jun 9	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019
CVE-2026-45500	6.1	0%	Jun 9	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019
CVE-2019-1266	6.1	2%	Sep 11	A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability' Affected: 2016; 2016; 2019; 2019
CVE-2019-0858	6.1	2%	Apr 9	A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability' Affected: 2013; 2016; 2016; 2019; 2019
CVE-2017-8758	6.1	3%	Sep 13	Microsoft Exchange Server 2016 allows an elevation of privilege vulnerability when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests, aka… Affected: 2016
CVE-2017-8621	6.1	3%	Jul 11	Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an open redirect vulnerability that could lead to… Affected: 2010; 2013; 2013; 2016
CVE-2017-8560	6.1	3%	Jul 11	Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way… Affected: 2013; 2013; 2016
CVE-2017-8559	6.1	3%	Jul 11	Microsoft Exchange Server 2010 SP3, Exchange Server 2013 SP3, Exchange Server 2013 CU16, and Exchange Server 2016 CU5 allows an elevation of privilege vulnerability due to the way… Affected: 2013; 2013; 2016
CVE-2017-0110	6.1	7%	Mar 17	Cross-site scripting (XSS) vulnerability in Microsoft Exchange Outlook Web Access (OWA) allows remote attackers to inject arbitrary web script or HTML via a crafted email or chat… Affected: 2013; 2013; 2013
CVE-2016-3379	6.1	8%	Sep 14	Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2016 Cumulative Update 1 and 2 allows remote attackers to inject arbitrary web script or HTML via a… Affected: 2016; 2016
CVE-2016-0032	6.1	8%	Jan 13	Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, 2013 Cumulative Update 11, and 2016 allows… Affected: 2013; 2013; 2013; 2016
CVE-2016-0031	6.1	8%	Jan 13	Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted… Affected: 2016
CVE-2016-0030	6.1	8%	Jan 13	Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2013 PS1, 2013 Cumulative Update 10, and 2016 allows remote attackers to inject… Affected: 2013; 2013; 2016
CVE-2016-0029	6.1	8%	Jan 13	Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2016 allows remote attackers to inject arbitrary web script or HTML via a crafted… Affected: 2016
CVE-2026-69382	5.9	0%	Sep 8	Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2019; 2019
CVE-2023-36777	5.7	52%	Sep 12	Microsoft Exchange Server Information Disclosure Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +29 more
CVE-2020-17083	5.5	12%	Nov 11	Microsoft Exchange Server Remote Code Execution Vulnerability Affected: 2013; 2016; 2016; 2019; 2019
CVE-2018-0941	5.5	12%	Mar 14	Microsoft Exchange Server 2016 Cumulative Update 7 and Microsoft Exchange Server 2016 Cumulative Update 8 allow an information disclosure vulnerability due to how data is… Affected: 2016; 2016
CVE-2017-8537	5.5	17%	May 26	The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… Affected: 2013; 2016
CVE-2017-8536	5.5	17%	May 26	The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… Affected: 2013; 2016
CVE-2017-8535	5.5	17%	May 26	The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows… Affected: 2013; 2016
CVE-2026-62914	5.4	0%	Aug 11	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2016; 2016; 2016; 2016; 2016; +31 more
CVE-2026-47631	5.4	0%	Jun 9	Microsoft Exchange Server Spoofing Vulnerability Affected: 2016; 2019; 2019
CVE-2021-1730	5.4	2%	Feb 25	<p>A spoofing vulnerability exists in Microsoft Exchange Server which could result in an attack that would allow a malicious actor to impersonate the user.</p> <p>This update… Affected: 2016; 2019
CVE-2020-0903	5.4	2%	Mar 12	A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka… Affected: 2016; 2016; 2019; 2019
CVE-2019-1137	5.4	2%	Jul 15	A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka… Affected: 2013; 2013; 2013; 2013; 2013; 2013; +34 more