Known vulnerabilities in Microsoft Exchange Server - page 2

Vendor: Microsoft
Software CPE: cpe:2.3:a:microsoft:microsoft_exchange_server:*:*:*:*:*:*:*:*
Total vulnerabilities: 225
Public exploits: 37
Known exploited (KEV): 20
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Microsoft Exchange Server Microsoft Exchange Server is affected by 225 known vulnerabilities: 8 critical, 47 high, 107 medium, 63 low Critical High Medium Low

Vulnerabilities (225)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU134075 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-47631
CWE-79 Low
No
No
SE RTM Jun26SU 15.02.2562.043, 2016 CU23 Jun26SU 15.01.2507.069, 2019 CU14 Jun26SU 15.02.1544.041, 2019 CU15 Jun26SU 15.02.1748.046 09.06.2026 SB2026060965
#VU134074 - Improper Control of Generation of Code ('Code Injection')
CVE-2026-45583
CWE-94 High
No
No
SE RTM Jun26SU 15.02.2562.043, 2016 CU23 Jun26SU 15.01.2507.069, 2019 CU14 Jun26SU 15.02.1544.041, 2019 CU15 Jun26SU 15.02.1748.046 09.06.2026 SB2026060965
#VU134073 - Server-Side Request Forgery (SSRF)
CVE-2026-45504
CWE-918 Medium
No
No
SE RTM Jun26SU 15.02.2562.043, 2016 CU23 Jun26SU 15.01.2507.069, 2019 CU14 Jun26SU 15.02.1544.041, 2019 CU15 Jun26SU 15.02.1748.046 09.06.2026 SB2026060965
#VU134072 - Server-Side Request Forgery (SSRF)
CVE-2026-45503
CWE-918 Medium
No
No
SE RTM Jun26SU 15.02.2562.043, 2016 CU23 Jun26SU 15.01.2507.069, 2019 CU14 Jun26SU 15.02.1544.041, 2019 CU15 Jun26SU 15.02.1748.046 09.06.2026 SB2026060965
#VU134071 - Server-Side Request Forgery (SSRF)
CVE-2026-45502
CWE-918 Medium
No
No
SE RTM Jun26SU 15.02.2562.043, 2016 CU23 Jun26SU 15.01.2507.069, 2019 CU14 Jun26SU 15.02.1544.041, 2019 CU15 Jun26SU 15.02.1748.046 09.06.2026 SB2026060965
#VU134070 - Server-Side Request Forgery (SSRF)
CVE-2026-45501
CWE-918 Medium
No
No
SE RTM Jun26SU 15.02.2562.043, 2016 CU23 Jun26SU 15.01.2507.069, 2019 CU14 Jun26SU 15.02.1544.041, 2019 CU15 Jun26SU 15.02.1748.046 09.06.2026 SB2026060965
#VU134069 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-45500
CWE-79 Low
No
No
SE RTM Jun26SU 15.02.2562.043, 2016 CU23 Jun26SU 15.01.2507.069, 2019 CU14 Jun26SU 15.02.1544.041, 2019 CU15 Jun26SU 15.02.1748.046 09.06.2026 SB2026060965
#VU131560 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CVE-2026-42897
CWE-79 High
No
Exploited
SE RTM Jun26SU 15.02.2562.043, 2016 CU23 Jun26SU 15.01.2507.069, 2019 CU14 Jun26SU 15.02.1544.041, 2019 CU15 Jun26SU 15.02.1748.046 15.05.2026 SB2026051542
#VU122555 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2026-21527
CWE-451 Medium
No
No
SE RTM Feb26SU 15.02.2562.037, 2016 CU23 Feb26SU 15.01.2507.066, 2019 CU14 Feb26SU 15.02.1544.039, 2019 CU15 Feb26SU 15.02.1748.043 10.02.2026 SB2026021066
#VU119438 - Improper input validation
CVE-2025-64666
CWE-20 Medium
No
No
SE RTM Dec25SU 15.02.2562.035, 2016 CU23 Dec25SU 15.01.2507.063, 2019 CU14 Dec25SU 15.02.1544.037, 2019 CU15 Dec25SU 15.02.1748.042 09.12.2025 SB2025120949
#VU119435 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2025-64667
CWE-451 Medium
No
No
SE RTM Dec25SU 15.02.2562.035, 2016 CU23 Dec25SU 15.01.2507.063, 2019 CU14 Dec25SU 15.02.1544.037, 2019 CU15 Dec25SU 15.02.1748.042 09.12.2025 SB2025120949
#VU117031 - Improper Authentication
CVE-2025-59249
CWE-287 Medium
No
No
SE RTM Oct25SU 15.02.2562.029, 2016 CU23 Oct25SU 15.01.2507.061, 2019 CU14 Oct25SU 15.02.1544.036, 2019 CU15 Oct25SU 15.02.1748.039 14.10.2025 SB2025101467
#VU117030 - Improper input validation
CVE-2025-59248
CWE-20 Medium
No
No
SE RTM Oct25SU 15.02.2562.029, 2016 CU23 Oct25SU 15.01.2507.061, 2019 CU14 Oct25SU 15.02.1544.036, 2019 CU15 Oct25SU 15.02.1748.039 14.10.2025 SB2025101467
#VU117029 - Improper Authentication
CVE-2025-53782
CWE-287 Low
No
No
SE RTM Oct25SU 15.02.2562.029, 2016 CU23 Oct25SU 15.01.2507.061, 2019 CU14 Oct25SU 15.02.1544.036, 2019 CU15 Oct25SU 15.02.1748.039 14.10.2025 SB2025101467
#VU113850 - Improper Validation of Syntactic Correctness of Input
CVE-2025-25007
CWE-1286 Medium
No
No
SE RTM Aug25SU 15.02.2562.020, 2016 CU23 Aug25SU 15.01.2507.058, 2019 CU14 15.02.1544.033, 2019 CU15 15.02.1748.036 12.08.2025 SB2025081268
#VU113849 - Improper Handling of Additional Special Element
CVE-2025-25006
CWE-167 Medium
No
No
SE RTM Aug25SU 15.02.2562.020, 2016 CU23 Aug25SU 15.01.2507.058, 2019 CU14 15.02.1544.033, 2019 CU15 15.02.1748.036 12.08.2025 SB2025081268
#VU113846 - Improper input validation
CVE-2025-25005
CWE-20 Medium
No
No
SE RTM Aug25SU 15.02.2562.020, 2016 CU23 Aug25SU 15.01.2507.058, 2019 CU14 15.02.1544.033, 2019 CU15 15.02.1748.036 12.08.2025 SB2025081268
#VU113842 - Exposure of sensitive information to an unauthorized actor
CVE-2025-33051
CWE-200 Medium
No
No
SE RTM Aug25SU 15.02.2562.020, 2016 CU23 Aug25SU 15.01.2507.058, 2019 CU14 15.02.1544.033, 2019 CU15 15.02.1748.036 12.08.2025 SB2025081268
#VU113714 - Improper Authentication
CVE-2025-53786
CWE-287 Medium
No
No
SE RTM 15.02.2562.017, 2016 CU23 Apr25HU 15.01.2507.055, 2019 CU14 Apr25HU 15.02.1544.025, 2019 CU15 Apr25HU 15.02.1748.024 06.08.2025 SB2025080631
#VU100312 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2024-49040
CWE-451 Medium
No
No
2016 CU23 Nov24HU 15.01.2507.043, 2019 CU13 Nov24HU 15.02.1258.038, 2019 CU14 Nov24HU 15.02.1544.013 12.11.2024 SB20241112115
SB20250328503
SB2025072236


Showing elements 21 - 40 out of 225