7.4

CVE-2018-8581: Microsoft Exchange Server Privilege Escalation Vulnerability

CVSS: 7.4v3.1HighKEVRansomwareAnalyzed
Published 14-11-2018Last modified 21-10-2025
Open JSON

Vulnerability summary

CVE-2018-8581 is a high (CVSS 7.4) vulnerability in Microsoft Exchange Server. It is known to be exploited: CISA lists it, first on 03-03-2022. It has been used in ransomware campaigns. EPSS estimates a 27.36% chance of exploitation in the next 30 days, higher than 98% of scored vulnerabilities.

Overall risk
90/100
0100
Critical · default modelHow is this calculated?
CVSS score
7.4/10
010
High · v3.1 (CVE.org)
EPSS score
27.36%
0%100%
High · 0.00 pp in 30 days
KEVListedCISA
RansomwareKnown useFlagged by CISA
Public exploits0No public exploits recorded

Timeline

  1. 14-11-2018
    PublishedVulnerability first disclosed.
  2. 03-03-2022
    Added to CISA KEVMicrosoft Exchange Server Privilege Escalation Vulnerability
  3. 17-03-2022
    CISA remediation dueApply updates per vendor instructions.
  4. 21-10-2025
    Last modifiedVulnerability information updated.

Description

An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

CVSS metrics

3 scores · 2 sources · 2 versions

EPSS trend

Probability

27.36%

Chance of exploitation in the next 30 days

Percentile

98%

Versus all other CVEs

30-day change

0.00 pp

From 27.36% on 18-09-2026

18-09-202618-10-2026
EPSS score
27.36%

Known exploited

Compare KEV catalogs
CISA KEVListed
Added
03-03-2022
Federal due date
17-03-2022
Ransomware

CISA required action

Apply updates per vendor instructions. nvd.nist.gov/vuln/detail/CVE-2018-8581

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

No weakness data has been published for this record.

Affected systems

Microsoft2 products

1 vendor · 2 products

References

4 links