Known vulnerabilities in Microsoft Exchange Server - page 2

Vendor: Microsoft
Software CPE: cpe:2.3:a:microsoft:microsoft_exchange_server:*:*:*:*:*:*:*:*
Total vulnerabilities: 216
Public exploits: 36
Known exploited (KEV): 20
Highest CVSSv4 Score: 9.4

Breakdown by Severity Chart

Severity distribution of vulnerabilities affecting Microsoft Exchange Server Microsoft Exchange Server is affected by 216 known vulnerabilities: 8 critical, 46 high, 102 medium, 60 low Critical High Medium Low

Vulnerabilities (216)

Vulnerability CWE-ID CSH Severity Public Exploit KEV First fixed release Published Bulletins
#VU119438 - Improper input validation
CVE-2025-64666
CWE-20 Medium
No
No
SE RTM Dec25SU 15.02.2562.035, 2016 CU23 Dec25SU 15.01.2507.063, 2019 CU14 Dec25SU 15.02.1544.037, 2019 CU15 Dec25SU 15.02.1748.042 09.12.2025 SB2025120949
#VU119435 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2025-64667
CWE-451 Medium
No
No
SE RTM Dec25SU 15.02.2562.035, 2016 CU23 Dec25SU 15.01.2507.063, 2019 CU14 Dec25SU 15.02.1544.037, 2019 CU15 Dec25SU 15.02.1748.042 09.12.2025 SB2025120949
#VU117031 - Improper Authentication
CVE-2025-59249
CWE-287 Medium
No
No
SE RTM Oct25SU 15.02.2562.029, 2016 CU23 Oct25SU 15.01.2507.061, 2019 CU14 Oct25SU 15.02.1544.036, 2019 CU15 Oct25SU 15.02.1748.039 14.10.2025 SB2025101467
#VU117030 - Improper input validation
CVE-2025-59248
CWE-20 Medium
No
No
SE RTM Oct25SU 15.02.2562.029, 2016 CU23 Oct25SU 15.01.2507.061, 2019 CU14 Oct25SU 15.02.1544.036, 2019 CU15 Oct25SU 15.02.1748.039 14.10.2025 SB2025101467
#VU117029 - Improper Authentication
CVE-2025-53782
CWE-287 Low
No
No
SE RTM Oct25SU 15.02.2562.029, 2016 CU23 Oct25SU 15.01.2507.061, 2019 CU14 Oct25SU 15.02.1544.036, 2019 CU15 Oct25SU 15.02.1748.039 14.10.2025 SB2025101467
#VU113850 - Improper Validation of Syntactic Correctness of Input
CVE-2025-25007
CWE-1286 Medium
No
No
SE RTM Aug25SU 15.02.2562.020, 2016 CU23 Aug25SU 15.01.2507.058, 2019 CU14 15.02.1544.033, 2019 CU15 15.02.1748.036 12.08.2025 SB2025081268
#VU113849 - Improper Handling of Additional Special Element
CVE-2025-25006
CWE-167 Medium
No
No
SE RTM Aug25SU 15.02.2562.020, 2016 CU23 Aug25SU 15.01.2507.058, 2019 CU14 15.02.1544.033, 2019 CU15 15.02.1748.036 12.08.2025 SB2025081268
#VU113846 - Improper input validation
CVE-2025-25005
CWE-20 Medium
No
No
SE RTM Aug25SU 15.02.2562.020, 2016 CU23 Aug25SU 15.01.2507.058, 2019 CU14 15.02.1544.033, 2019 CU15 15.02.1748.036 12.08.2025 SB2025081268
#VU113842 - Exposure of sensitive information to an unauthorized actor
CVE-2025-33051
CWE-200 Medium
No
No
SE RTM Aug25SU 15.02.2562.020, 2016 CU23 Aug25SU 15.01.2507.058, 2019 CU14 15.02.1544.033, 2019 CU15 15.02.1748.036 12.08.2025 SB2025081268
#VU113714 - Improper Authentication
CVE-2025-53786
CWE-287 Medium
No
No
SE RTM 15.02.2562.017, 2016 CU23 Apr25HU 15.01.2507.055, 2019 CU14 Apr25HU 15.02.1544.025, 2019 CU15 Apr25HU 15.02.1748.024 06.08.2025 SB2025080631
#VU100312 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)
CVE-2024-49040
CWE-451 Medium
No
No
2016 CU23 Nov24HU 15.01.2507.043, 2019 CU13 Nov24HU 15.02.1258.038, 2019 CU14 Nov24HU 15.02.1544.013 12.11.2024 SB20241112115
SB20250328503
SB2025072236
#VU87349 - Uncontrolled Search Path Element
CVE-2024-26198
CWE-427 High
No
No
2016 CU23 Mar24SU 15.01.2507.037, 2019 CU13 Mar24SU 15.02.1258.032, 2019 CU14 Mar24SU 15.02.1544.009 12.03.2024 SB20240312298
#VU86404 - Exposure of resource to wrong sphere
CVE-2024-21410
CWE-668 Critical
No
Exploited
2019 CU14 2024H1 15.02.1544.004 13.02.2024 SB2024021336
#VU83069 - Deserialization of Untrusted Data
CVE-2023-36050
CWE-502 Medium
No
No
2016 CU23 Nov23SU 15.01.2507.035, 2019 CU12 Nov23SU 15.02.1118.040, 2019 CU13 Nov23SU 15.02.1258.028 14.11.2023 SB2023111454
#VU83067 - Exposure of sensitive information to an unauthorized actor
CVE-2023-36035
CWE-200 Medium
No
No
2016 CU23 Nov23SU 15.01.2507.035, 2019 CU12 Nov23SU 15.02.1118.040, 2019 CU13 Nov23SU 15.02.1258.028 14.11.2023 SB2023111454
#VU83066 - Deserialization of Untrusted Data
CVE-2023-36039
CWE-502 Medium
No
No
2016 CU23 Nov23SU 15.01.2507.035, 2019 CU12 Nov23SU 15.02.1118.040, 2019 CU13 Nov23SU 15.02.1258.028 14.11.2023 SB2023111454
#VU83064 - Deserialization of Untrusted Data
CVE-2023-36439
CWE-502 Medium
No
No
2016 CU23 Nov23SU 15.01.2507.035, 2019 CU12 Nov23SU 15.02.1118.040, 2019 CU13 Nov23SU 15.02.1258.028 14.11.2023 SB2023111454
#VU82692 - Deserialization of Untrusted Data
CWE-502 High
No
No
- 02.11.2023 SB2023110257
#VU82691 - Server-Side Request Forgery (SSRF)
CWE-918 Medium
No
No
- 02.11.2023 SB2023110256
#VU81831 - Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CVE-2023-36778
CWE-78 Medium
No
No
2016 CU23 Oct23SU 15.01.2507.034, 2019 CU12 Oct23SU 15.02.1118.039, 2019 CU13 Oct23SU 15.02.1258.027 10.10.2023 SB2023101094


Showing elements 21 - 40 out of 216