CVE-2026-69355

Microsoft Exchange Server Remote Code Execution Vulnerability

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVSS 3.1 · 8.8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 3 more

CVE-2026-69356

Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

CVSS 3.1 · 9.3 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 2 more

CVE-2026-69361

Microsoft Exchange Server Spoofing Vulnerability

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 6 more

CVE-2026-69375

Microsoft Exchange Server Tampering Vulnerability

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 2 more

CVE-2026-69378

Microsoft Exchange Server Denial of Service Vulnerability

Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.

CVSS 3.1 · 7.5 High EPSS 1.2% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 2 more

CVE-2026-69380

Microsoft Exchange Server Elevation of Privilege Vulnerability

Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8.1 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 2 more

CVE-2026-69382

Microsoft Exchange Server Information Disclosure Vulnerability

Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

CVSS 3.1 · 5.9 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 6 more

CVE-2026-69641

Microsoft Exchange Server Elevation of Privilege Vulnerability

Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 9.1 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 2 more

CVE-2026-62911

Microsoft Exchange Server Elevation of Privilege Vulnerability

Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 8 High EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 2 more

CVE-2026-65813

Microsoft Exchange Server Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVSS 3.1 · 6.5 Medium EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server Exchange Server 2016 Exchange Server 2019 and 6 more

CVE-2026-65801

Microsoft Exchange Online Elevation of Privilege Vulnerability

Server-side request forgery (ssrf) in Microsoft Exchange Online allows an unauthorized attacker to elevate privileges over a network.

CVSS 3.1 · 10 Critical EPSS < 1% KEV · Not listed

Vendors

Microsoft

Products

Exchange Online

CVE-2021-26857

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS 3.1 · 7.8 High EPSS 95.8% KEV · Listed

Vendors

Microsoft

Products

Exchange Server

CVE-2021-27078

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS 3.1 · 9.1 Critical EPSS 18.0% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server

CVE-2021-26855

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS 3.1 · 9.1 Critical EPSS 100.0% KEV · Listed

Vendors

Microsoft

Products

Exchange Server

CVE-2021-26854

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS 3.1 · 6.6 Medium EPSS 20.7% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server

CVE-2021-26412

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS 3.1 · 9.1 Critical EPSS 28.6% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server

CVE-2021-42305

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Exchange Server Spoofing Vulnerability

CVSS 3.1 · 6.5 Medium EPSS 7.9% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server

CVE-2021-41349

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Exchange Server Spoofing Vulnerability

CVSS 3.1 · 6.5 Medium EPSS 93.5% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server

CVE-2023-21710

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS 3.1 · 7.2 High EPSS 7.9% KEV · Not listed

Vendors

Microsoft

Products

Exchange Server

CVE-2021-42321

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server Remote Code Execution Vulnerability

CVSS 3.1 · 8.8 High EPSS 91.7% KEV · Listed

Vendors

Microsoft

Products

Exchange Server