Known vulnerabilities in Microsoft Exchange Server

Vendor: Microsoft
Software CPE: cpe:2.3:a:microsoft:microsoft_exchange_server:*:*:*:*:*:*:*:*
Total vulnerabilities: 225
Public exploits: 37
Known exploited (KEV): 20
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Microsoft Exchange Server Microsoft Exchange Server is affected by 225 known vulnerabilities: 8 critical, 47 high, 107 medium, 63 low Critical High Medium Low

Vulnerabilities (225)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU147868 - Missing Authorization
CVE-2026-69641
CWE-862 Low
No
No
SE RTM Sep26SU 15.02.2562.049, 2016 CU23 Sep26SU 15.01.2507.073, 2019 CU14 Sep26SU 15.02.1544.046, 2019 CU15 Sep26SU 15.02.1748.051 08.09.2026 SB2026090908
#VU147646 - Use of a Broken or Risky Cryptographic Algorithm
CVE-2026-69382
CWE-327 Medium
No
No
SE RTM Sep26SU 15.02.2562.049, 2016 CU23 Sep26SU 15.01.2507.073, 2019 CU14 Sep26SU 15.02.1544.046, 2019 CU15 Sep26SU 15.02.1748.051 08.09.2026 SB2026090908
#VU147644 - Missing Authorization
CVE-2026-69380
CWE-862 Medium
No
No
SE RTM Sep26SU 15.02.2562.049, 2016 CU23 Sep26SU 15.01.2507.073, 2019 CU14 Sep26SU 15.02.1544.046, 2019 CU15 Sep26SU 15.02.1748.051 08.09.2026 SB2026090908
#VU147642 - Uncontrolled Recursion
CVE-2026-69378
CWE-674 Medium
No
No
SE RTM Sep26SU 15.02.2562.049, 2016 CU23 Sep26SU 15.01.2507.073, 2019 CU14 Sep26SU 15.02.1544.046, 2019 CU15 Sep26SU 15.02.1748.051 08.09.2026 SB2026090908
#VU147639 - Authorization Bypass Through User-Controlled Key
CVE-2026-69375
CWE-639 Low
No
No
SE RTM Sep26SU 15.02.2562.049, 2016 CU23 Sep26SU 15.01.2507.073, 2019 CU14 Sep26SU 15.02.1544.046, 2019 CU15 Sep26SU 15.02.1748.051 08.09.2026 SB2026090908
#VU147627 - Server-Side Request Forgery (SSRF)
CVE-2026-69361
CWE-918 Low
No
No
SE RTM Sep26SU 15.02.2562.049, 2016 CU23 Sep26SU 15.01.2507.073, 2019 CU14 Sep26SU 15.02.1544.046, 2019 CU15 Sep26SU 15.02.1748.051 08.09.2026 SB2026090908
#VU147622 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-69356
CWE-79 Medium
No
No
SE RTM Sep26SU 15.02.2562.049, 2016 CU23 Sep26SU 15.01.2507.073, 2019 CU14 Sep26SU 15.02.1544.046, 2019 CU15 Sep26SU 15.02.1748.051 08.09.2026 SB2026090908
#VU147621 - External Control of File Name or Path
CVE-2026-69355
CWE-73 Medium
No
No
SE RTM Sep26SU 15.02.2562.049, 2016 CU23 Sep26SU 15.01.2507.073, 2019 CU14 Sep26SU 15.02.1544.046, 2019 CU15 Sep26SU 15.02.1748.051 08.09.2026 SB2026090908
#VU147473 - Double Free
CVE-2026-55007
CWE-415 High
No
No
SE RTM Sep26SU 15.02.2562.049, 2019 CU14 Sep26SU 15.02.1544.046, 2019 CU15 Sep26SU 15.02.1748.051 08.09.2026 SB2026090908
#VU141972 - Authentication Bypass by Capture-replay
CVE-2026-62911
CWE-294 Medium
Available
No
SE RTM Aug26SU 15.02.2562.046, 2016 CU23 Aug26SU 15.01.2507.072, 2019 CU14 Aug26SU 15.02.1544.044, 2019 CU15 Aug26SU 15.02.1748.049 12.08.2026 SB2026081147
#VU141479 - Server-Side Request Forgery (SSRF)
CVE-2026-65813
CWE-918 Low
No
No
SE RTM Aug26SU 15.02.2562.046, 2016 CU23 Aug26SU 15.01.2507.072, 2019 CU14 Aug26SU 15.02.1544.044, 2019 CU15 Aug26SU 15.02.1748.049 11.08.2026 SB2026081147
#VU141478 - Missing Authorization
CVE-2026-62915
CWE-862 Low
No
No
SE RTM Aug26SU 15.02.2562.046, 2016 CU23 Aug26SU 15.01.2507.072, 2019 CU14 Aug26SU 15.02.1544.044, 2019 CU15 Aug26SU 15.02.1748.049 11.08.2026 SB2026081147
#VU141476 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-62914
CWE-79 Low
No
No
SE RTM Aug26SU 15.02.2562.046, 2016 CU23 Aug26SU 15.01.2507.072, 2019 CU14 Aug26SU 15.02.1544.044, 2019 CU15 Aug26SU 15.02.1748.049 11.08.2026 SB2026081147
#VU141475 - Heap-based Buffer Overflow
CVE-2026-62913
CWE-122 Medium
No
No
SE RTM Aug26SU 15.02.2562.046, 2016 CU23 Aug26SU 15.01.2507.072, 2019 CU14 Aug26SU 15.02.1544.044, 2019 CU15 Aug26SU 15.02.1748.049 11.08.2026 SB2026081147
#VU141474 - Deserialization of Untrusted Data
CVE-2026-62912
CWE-502 Low
No
No
SE RTM Aug26SU 15.02.2562.046, 2016 CU23 Aug26SU 15.01.2507.072, 2019 CU14 Aug26SU 15.02.1544.044, 2019 CU15 Aug26SU 15.02.1748.049 11.08.2026 SB2026081147
#VU141473 - Improper Control of Resource Identifiers ('Resource Injection')
CVE-2026-62910
CWE-99 Low
No
No
SE RTM Aug26SU 15.02.2562.046, 2016 CU23 Aug26SU 15.01.2507.072, 2019 CU14 Aug26SU 15.02.1544.044, 2019 CU15 Aug26SU 15.02.1748.049 11.08.2026 SB2026081147
#VU137892 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-55008
CWE-79 Low
No
No
SE RTM Jul26SU 15.02.2562.045, 2016 CU23 Jul26SU 15.01.2507.071, 2019 CU14 Jul26SU 15.02.1544.043, 2019 CU15 Jul26SU 15.02.1748.048 16.07.2026 SB2026071628
#VU137891 - Insufficient Granularity of Access Control
CVE-2026-55006
CWE-1220 Low
No
No
SE RTM Jul26SU 15.02.2562.045, 2016 CU23 Jul26SU 15.01.2507.071, 2019 CU14 Jul26SU 15.02.1544.043, 2019 CU15 Jul26SU 15.02.1748.048 16.07.2026 SB2026071628
#VU137890 - Heap-based Buffer Overflow
CVE-2026-55005
CWE-122 Medium
No
No
SE RTM Jul26SU 15.02.2562.045, 2016 CU23 Jul26SU 15.01.2507.071, 2019 CU14 Jul26SU 15.02.1544.043, 2019 CU15 Jul26SU 15.02.1748.048 16.07.2026 SB2026071628
#VU137889 - Deserialization of Untrusted Data
CVE-2026-55009
CWE-502 Low
No
No
SE RTM Jul26SU 15.02.2562.045, 2016 CU23 Jul26SU 15.01.2507.071, 2019 CU14 Jul26SU 15.02.1544.043, 2019 CU15 Jul26SU 15.02.1748.048 16.07.2026 SB2026071628


Showing elements 1 - 20 out of 225