Microsoft Exchange Server Subscription Edition vulnerabilities, page 2
40 vulnerabilities
Known vulnerabilities in Microsoft Exchange Server Subscription Edition, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-62915microsoftexchange_server+5
EPSS score0.64%
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.CVE-2026-62911microsoftexchange_server+5EPSS score0.69%
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-62914microsoftexchange_server+5EPSS score0.45%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.CVE-2026-47631microsoftexchange_server+5EPSS score0.47%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-42897microsoftexchange_server+5KEVEPSS score0.52%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-69375microsoftexchange_server+5EPSS score0.64%
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.CVE-2026-69356microsoftexchange_server+5EPSS score0.76%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-69355microsoftexchange_server+5EPSS score0.91%
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.CVE-2026-69378microsoftexchange_server+5EPSS score1.17%
Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.CVE-2026-69382microsoftexchange_server+5EPSS score0.47%
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.CVE-2026-69641microsoftexchange_server+5EPSS score0.86%
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-69380microsoftexchange_server+5EPSS score0.69%
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-69361microsoftexchange_server+5EPSS score0.84%
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.CVE-2026-45500microsoftexchange_server+5EPSS score0.41%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-45504microsoftexchange_server+5EPSS score0.78%
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-45503microsoftexchange_server+5EPSS score0.86%
Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.CVE-2026-45501microsoftexchange_server+5EPSS score0.46%
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.CVE-2026-45583microsoftexchange_server+5EPSS score0.70%
Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.CVE-2026-45502microsoftexchange_server+5EPSS score0.64%
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.CVE-2026-96940microsoftexchange_server+5EPSS score0.48%
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.