Microsoft Microsoft Exchange Server 2016 Cumulative Update 23

Name: Microsoft Microsoft Exchange Server 2016 Cumulative Update 23
Brand: Microsoft

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

3critical22high9medium0low

updated 2026-10-26

vulnerabilities (91)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2022-41082US	—OT critical	100.0% (100th)	KEV	15.01.2507.016	2022-10-03	15.01.0 → 15.01.2507.016
CVE-2022-41040US	—OT critical	100.0% (100th)	KEV	15.01.2507.016	2022-10-03	15.01.0 → 15.01.2507.016
CVE-2022-41080US	—OT critical	77.3% (100th)	KEV	15.01.2507.016	2022-11-09	15.01.0 → 15.01.2507.016
CVE-2026-42897US	medium6.1OT critical	70.7% (99th)	KEV	15.01.2507.069	2026-05-14	4 versions
CVE-2024-21410US	—OT critical	12.7% (96th)	KEV	15.01.2507.037	2024-02-13	15.01.0 → 15.01.2507.037
CVE-2023-21529US	—OT critical	59.3% (99th)	KEV	15.01.2507.021	2023-02-14	15.01.0 → 15.01.2507.021
CVE-2023-21707US	—	82.0% (100th)	Exploit	15.01.2507.023	2023-02-14	15.01.0 → 15.01.2507.023
CVE-2023-32031US	—	81.5% (100th)	Exploit	15.01.2507.027	2023-06-14	15.01.0 → 15.01.2507.027
CVE-2023-36745US	—	76.2% (100th)	Exploit	15.01.2507.032	2023-09-12	15.01.0 → 15.01.2507.032
CVE-2025-53786US	—	7.71% (95th)	Exploit	15.01.2507.055	2025-08-06	2 versions
CVE-2026-96940US	high8.8	2.75% (86th)	Exploit	15.01.2507.075	2026-10-02	3 versions
CVE-2026-45504US	—	1.18% (67th)	Exploit	15.01.2507.071	2026-06-09	4 versions
CVE-2026-54998US	—OT elevated	0.78% (56th)	Exploit	no fix	2026-07-02	≤ vers:unknown/*
CVE-2026-62911US	—OT elevated	0.69% (53rd)	Exploit	15.01.2507.072	2026-08-11	4 versions
CVE-2023-36035US	high8.0	86.6% (100th)	—	15.01.2507.035	2023-11-14	15.01.0 → 15.01.2507.035
CVE-2023-36039US	high8.0	73.0% (99th)	—	15.01.2507.035	2023-11-14	15.01.0 → 15.01.2507.035
CVE-2023-36744US	—	57.1% (99th)	—	15.01.2507.032	2023-09-12	15.01.0 → 15.01.2507.032
CVE-2023-36777US	—	52.0% (99th)	—	15.01.2507.032	2023-09-12	15.01.0 → 15.01.2507.032
CVE-2023-36756US	—	49.2% (99th)	—	15.01.2507.032	2023-09-12	15.01.0 → 15.01.2507.032
CVE-2023-36050US	high8.0	39.2% (99th)	—	15.01.2507.035	2023-11-14	15.01.0 → 15.01.2507.035
CVE-2023-36757US	—	36.9% (99th)	—	15.01.2507.032	2023-09-12	15.01.0 → 15.01.2507.032
CVE-2023-28310US	—	25.0% (98th)	—	15.01.2507.027	2023-06-14	15.01.0 → 15.01.2507.027
CVE-2026-45502US	—	20.3% (97th)	—	15.01.2507.071	2026-06-09	4 versions
CVE-2023-38181US	—	10.8% (96th)	—	15.01.2507.032	2023-08-08	15.01.0 → 15.01.2507.032
CVE-2024-49040US	—	8.47% (95th)	—	15.01.2507.044	2024-11-12	15.01.0 → 15.01.2507.044
CVE-2026-21527US	—OT elevated	8.26% (95th)	—	15.01.2507.066	2026-02-10	2 versions
CVE-2023-21710US	—	7.87% (95th)	—	15.01.2507.021	2023-02-14	15.01.0 → 15.01.2507.021
CVE-2023-35388US	—	6.85% (94th)	—	15.01.2507.032	2023-08-08	15.01.0 → 15.01.2507.032
CVE-2024-26198US	—	6.82% (94th)	—	15.01.2507.039	2024-03-12	2 versions
CVE-2023-38182US	—	5.92% (93rd)	—	15.01.2507.032	2023-08-08	15.01.0 → 15.01.2507.032
CVE-2023-36439US	high8.0	4.96% (92nd)	—	15.01.2507.035	2023-11-14	15.01.0 → 15.01.2507.035
CVE-2023-21706US	—	4.06% (91st)	—	15.01.2507.021	2023-02-14	15.01.0 → 15.01.2507.021
CVE-2022-21980US	—	2.74% (86th)	—	15.01.2507.013	2022-08-09	15.01.0 → 15.01.2507.013
CVE-2023-38185US	—	2.68% (86th)	—	15.01.2507.032	2023-08-08	15.01.0 → 15.01.2507.032
CVE-2026-55009US	—	2.51% (85th)	—	15.01.2507.071	2026-07-14	4 versions
CVE-2023-35368US	—	2.49% (85th)	—	15.01.2507.032	2023-08-08	15.01.0 → 15.01.2507.032
CVE-2022-24516US	—	2.45% (84th)	—	15.01.2507.013	2022-08-09	15.01.0 → 15.01.2507.013
CVE-2023-36778US	—	2.33% (83rd)	—	15.01.2507.034	2023-10-10	15.01.0 → 15.01.2507.034
CVE-2022-24477US	—	2.31% (83rd)	—	15.01.2507.013	2022-08-09	15.01.0 → 15.01.2507.013
CVE-2022-21979US	—	2.22% (83rd)	—	15.01.2507.013	2022-08-09	15.01.0 → 15.01.2507.013
CVE-2022-30134US	—	2.14% (82nd)	—	15.01.2507.013	2022-08-09	15.01.0 → 15.01.2507.013
CVE-2023-21709US	—	1.98% (80th)	—	15.01.2507.032	2023-08-08	15.01.0 → 15.01.2507.032
CVE-2026-62912US	—	1.98% (80th)	—	15.01.2507.072	2026-08-11	4 versions
CVE-2022-34692US	—	1.76% (78th)	—	15.01.2507.012	2022-08-09	15.01.0 → 15.01.2507.012
CVE-2026-87692US	high7.8	1.68% (77th)	—	15.01.2507.077	2026-10-13	3 versions
CVE-2023-21761US	—	1.64% (76th)	—	15.01.2507.017	2023-01-10	15.01.0 → 15.01.2507.017
CVE-2023-21762US	—	1.59% (76th)	—	15.01.2507.017	2023-01-10	15.01.0 → 15.01.2507.017
CVE-2023-21745US	—	1.54% (75th)	—	15.01.2507.017	2023-01-10	15.01.0 → 15.01.2507.017
CVE-2025-25005US	medium6.5	1.41% (72nd)	—	15.01.2507.058	2025-08-12	15.01.0.0 → 15.01.2507.058
CVE-2026-70571US	high8.1	1.39% (72nd)	—	15.01.2507.077	2026-10-13	3 versions

showing 50 of 91

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-502Deserialization of Untrusted Data24 CVEs
CWE-264CWE-26411 CVEs
CWE-20Improper Input Validation10 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor8 CVEs
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')8 CVEs
CWE-918Server-Side Request Forgery (SSRF)8 CVEs
CWE-451User Interface (UI) Misrepresentation of Critical Information6 CVEs
CWE-287Improper Authentication5 CVEs

sources (3)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)73 CVEs
NLNCSC-NL (CSAF)44 CVEs
USMicrosoft MSRC (CSAF)37 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan