Microsoft Exchange Server vulnerabilities, page 5
254 vulnerabilities
Known vulnerabilities in Microsoft Exchange Server, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2025-53786microsoftexchange_server+5
EPSS score7.71%
On April 18th 2025, Microsoft announced Exchange Server Security Changes for Hybrid Deployments and accompanying non-security Hot Fix. Microsoft made these changes in the general interest of improving the security of hybrid Exchange deployments. Following further investigation, Microsoft identified specific security implications tied to the guidance and configuration steps outlined in the April announcement. Microsoft is issuing CVE-2025-53786 to document a vulnerability that is addressed by taking the steps documented with the April 18th announcement. Microsoft strongly recommends reading the information, installing the April 2025 (or later) Hot Fix and implementing the changes in your Exchange Server and hybrid environment.CVE-2025-64666microsoftexchange_server+5EPSS score1.02%
Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2025-64667microsoftexchange_server+5EPSS score0.80%
User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2025-33051microsoftexchange_server+5EPSS score1.27%
Exposure of sensitive information to an unauthorized actor in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.CVE-2020-16969microsoftexchange_server+5EPSS score2.73%
<p>An information disclosure vulnerability exists in how Microsoft Exchange validates tokens when handling certain messages. An attacker who successfully exploited the vulnerability could use this to gain further information from a user.</p>
<p>To exploit the vulnerability, an attacker could include specially crafted OWA messages that could be loaded, without warning or filtering, from the attacker-controlled URL. This callback vector provides an information disclosure tactic used in web beacons and other types of tracking systems.</p>
<p>The security update corrects the way that Exchange handles these token validations.</p>CVE-2020-16875microsoftexchange_server+4EPSS score46.50%
<p>A remote code execution vulnerability exists in Microsoft Exchange server due to improper validation of cmdlet arguments.</p>
<p>An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the System user. Exploitation of the vulnerability requires an authenticated user in a certain Exchange role to be compromised.</p>
<p>The security update addresses the vulnerability by correcting how Microsoft Exchange handles cmdlet arguments.</p>CVE-2020-0692microsoftexchange_server+5EPSS score3.26%
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.CVE-2020-0688microsoftexchange_server+6KEVRansomwareEPSS score99.96%
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'.CVE-2020-0903microsoftexchange_server+4EPSS score1.65%
A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Server Spoofing Vulnerability'.CVE-2020-17141microsoftexchange_server+4EPSS score6.63%
Microsoft Exchange Remote Code Execution VulnerabilityCVE-2020-17132microsoftexchange_server+5EPSS score89.90%
Microsoft Exchange Remote Code Execution VulnerabilityCVE-2020-17084microsoftexchange_server+5EPSS score3.85%
Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2020-17085microsoftexchange_server+5EPSS score3.63%
Microsoft Exchange Server Denial of Service VulnerabilityCVE-2020-17142microsoftexchange_server+5EPSS score3.37%
Microsoft Exchange Remote Code Execution VulnerabilityCVE-2020-17117microsoftexchange_server+5EPSS score48.87%
Microsoft Exchange Remote Code Execution VulnerabilityCVE-2020-17144microsoftexchange_server+1KEVEPSS score36.51%
Microsoft Exchange Remote Code Execution VulnerabilityCVE-2020-17143microsoftexchange_server+5EPSS score70.63%
Microsoft Exchange Server Information Disclosure VulnerabilityCVE-2020-17083microsoftexchange_server+5EPSS score11.98%
Microsoft Exchange Server Remote Code Execution VulnerabilityCVE-2014-6336microsoftexchange_serverEPSS score7.07%
Outlook Web App (OWA) in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 does not properly validate redirection tokens, which allows remote attackers to redirect users to arbitrary web sites and spoof the origin of e-mail messages via unspecified vectors, aka "Exchange URL Redirection Vulnerability."CVE-2014-6326microsoftexchange_serverEPSS score8.72%
Cross-site scripting (XSS) vulnerability in Microsoft Exchange Server 2013 SP1 and Cumulative Update 6 allows remote attackers to inject arbitrary web script or HTML via a crafted URL, aka "OWA XSS Vulnerability," a different vulnerability than CVE-2014-6325.