Microsoft Exchange Server Subscription Edition RTM vulnerabilities, page 2
46 vulnerabilities
Known vulnerabilities in Microsoft Exchange Server Subscription Edition RTM, newest first, with CVSS severity, EPSS, KEV listings, ransomware use and the affected versions.
CVE-2026-55007microsoftexchange_server+4
EPSS score0.71%
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.CVE-2026-55009microsoftexchange_server+5EPSS score2.51%
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.CVE-2026-65813microsoftexchange_server+5EPSS score0.94%
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-62912microsoftexchange_server+5EPSS score1.98%
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.CVE-2026-62913microsoftexchange_server+5EPSS score0.91%
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.CVE-2026-62910microsoftexchange_server+5EPSS score1.00%
Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-62915microsoftexchange_server+5EPSS score0.64%
Missing authorization in Microsoft Exchange Server allows an authorized attacker to bypass a security feature over a network.CVE-2026-62911microsoftexchange_server+5EPSS score0.69%
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-62914microsoftexchange_server+5EPSS score0.45%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.CVE-2026-47631microsoftexchange_server+5EPSS score0.47%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-42897microsoftexchange_server+5KEVEPSS score0.52%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-69375microsoftexchange_server+5EPSS score0.64%
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.CVE-2026-69356microsoftexchange_server+5EPSS score0.76%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-69355microsoftexchange_server+5EPSS score0.91%
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.CVE-2026-69378microsoftexchange_server+5EPSS score1.17%
Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.CVE-2026-69382microsoftexchange_server+5EPSS score0.47%
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.CVE-2026-69641microsoftexchange_server+5EPSS score0.86%
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-69380microsoftexchange_server+5EPSS score0.69%
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-69361microsoftexchange_server+5EPSS score0.84%
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.CVE-2026-45500microsoftexchange_server+5EPSS score0.41%
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.