Microsoft Microsoft Office Online Server

Name: Microsoft Microsoft Office Online Server
Brand: Microsoft

productEU

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

KEV-listed

by severity

1critical20high45medium3low

updated 2026-10-28

vulnerabilities (85)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2023-21716US	critical9.8	84.8% (100th)	Exploit	16.0.10395.20001	2023-02-14	16.0.1 → 16.0.10395.20001
CVE-2023-23396US	medium6.5	3.83% (90th)	Exploit	16.0.10396.20000	2023-03-14	16.0.1 → 16.0.10396.20000
CVE-2023-33137US	—	2.75% (86th)	Exploit	16.0.10399.20000	2023-06-14	16.0.1 → 16.0.10399.20000
CVE-2023-23399US	—	2.53% (85th)	Exploit	16.0.10396.20000	2023-03-14	16.0.1 → 16.0.10396.20000
CVE-2023-32029US	—	53.5% (99th)	—	16.0.10399.20000	2023-06-14	16.0.1 → 16.0.10399.20000
CVE-2021-34501US	medium6.8	51.7% (99th)	—	16.0.10376.20001	2021-07-14	16.0.1 → 16.0.10376.20001
CVE-2023-33133US	—	44.0% (99th)	—	16.0.10399.20000	2023-06-14	16.0.1 → 16.0.10399.20000
CVE-2019-0585US	high8.8	22.0% (98th)	—	no fix	2019-01-08	≤ Microsoft Office Online Server
CVE-2021-31178US	medium4.3	16.0% (97th)	—	16.0.10374.20000	2021-05-11	16.0.1 → 16.0.10374.20000
CVE-2021-31179US	medium6.8	13.5% (96th)	—	16.0.10374.20000	2021-05-11	16.0.1 → 16.0.10374.20000
CVE-2019-0953US	high7.8	12.9% (96th)	—	no fix	2019-05-16	≤ unspecified
CVE-2020-0852US	high7.8	12.0% (96th)	—	no fix	2020-03-12	≤ unspecified
CVE-2020-0980US	high7.8	11.8% (96th)	—	no fix	2020-04-15	≤ unspecified
CVE-2020-0892US	high7.8	11.8% (96th)	—	no fix	2020-03-12	≤ unspecified
CVE-2020-1446US	high8.8	11.2% (96th)	—	no fix	2020-07-14	≤ unspecified
CVE-2020-1447US	high8.8	10.6% (96th)	—	no fix	2020-07-14	≤ unspecified
CVE-2020-1448US	high8.8	9.96% (96th)	—	no fix	2020-07-14	≤ unspecified
CVE-2019-1446US	medium5.5	8.94% (95th)	—	no fix	2019-11-12	≤ unspecified
CVE-2020-0850US	high8.8	8.82% (95th)	—	no fix	2020-03-12	≤ unspecified
CVE-2019-1035US	high7.8	6.56% (94th)	—	publication	2019-06-12	16.0.1 → publication
CVE-2020-1342US	medium5.5	6.41% (94th)	—	no fix	2020-07-14	≤ unspecified
CVE-2021-38655US	medium6.8	6.39% (94th)	—	10378.20000	2021-09-15	16.0.1 → 10378.20000
CVE-2020-1445US	medium5.5	6.12% (93rd)	—	no fix	2020-07-14	≤ unspecified
CVE-2021-40486US	medium6.8	5.99% (93rd)	—	16.0.10379.20000	2021-10-13	16.0.1 → 16.0.10379.20000
CVE-2020-1583US	medium4.3	4.91% (92nd)	—	publication	2020-08-17	16.0.1 → publication
CVE-2019-1034US	high7.8	4.88% (92nd)	—	publication	2019-06-12	16.0.1 → publication
CVE-2019-1201US	high7.8	4.86% (92nd)	—	publication	2019-08-14	16.0.1 → publication
CVE-2020-16932US	medium6.8	4.82% (92nd)	—	publication	2020-10-16	16.0.1 → publication
CVE-2020-16931US	medium6.8	4.82% (92nd)	—	publication	2020-10-16	16.0.1 → publication
CVE-2020-1502US	medium5.5	4.64% (92nd)	—	publication	2020-08-17	16.0.1 → publication
CVE-2022-22716US	medium4.3	4.60% (92nd)	—	16.0.10383.20001	2022-02-09	16.0.1 → 16.0.10383.20001
CVE-2021-27053US	medium6.8	4.58% (92nd)	—	publication	2021-03-11	16.0.1 → publication
CVE-2020-1503US	medium5.5	4.55% (92nd)	—	publication	2020-08-17	16.0.1 → publication
CVE-2020-1224US	medium4.3	4.35% (91st)	—	publication	2020-09-11	16.0.1 → publication
CVE-2021-27057US	medium6.8	4.32% (91st)	—	publication	2021-03-11	16.0.1 → publication
CVE-2021-27054US	medium6.8	4.32% (91st)	—	publication	2021-03-11	16.0.1 → publication
CVE-2020-17065US	high9.3	4.13% (91st)	—	publication	2020-11-11	16.0.1 → publication
CVE-2021-28453US	medium6.8	4.05% (91st)	—	publication	2021-04-13	16.0.1 → publication
CVE-2019-1205US	high7.8	3.97% (90th)	—	publication	2019-08-14	16.0.1 → publication
CVE-2021-1716US	high9.3	3.89% (90th)	—	publication	2021-01-12	16.0.1 → publication
CVE-2021-1715US	high9.3	3.89% (90th)	—	publication	2021-01-12	16.0.1 → publication
CVE-2020-1338US	medium6.8	3.85% (90th)	—	publication	2020-09-11	16.0.1 → publication
CVE-2020-1335US	medium6.8	3.85% (90th)	—	publication	2020-09-11	16.0.1 → publication
CVE-2020-1218US	medium6.8	3.83% (90th)	—	publication	2020-09-11	16.0.1 → publication
CVE-2020-16929US	medium6.8	3.70% (90th)	—	publication	2020-10-16	16.0.1 → publication
CVE-2021-28456US	medium4.3	3.67% (90th)	—	publication	2021-04-13	16.0.1 → publication
CVE-2018-8247US	medium5.4	3.47% (89th)	—	no fix	2018-06-14	≤ 2016
CVE-2020-17129US	high9.3	3.46% (89th)	—	publication	2020-12-10	16.0.1 → publication
CVE-2020-17125US	high9.3	3.46% (89th)	—	publication	2020-12-10	16.0.1 → publication
CVE-2020-17064US	medium6.8	3.42% (89th)	—	publication	2020-11-11	16.0.1 → publication

showing 50 of 85

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer24 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')18 CVEs
CWE-20Improper Input Validation15 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor15 CVEs
CWE-416Use After Free10 CVEs
CWE-125Out-of-bounds Read8 CVEs
CWE-908Use of Uninitialized Resource3 CVEs
CWE-122Heap-based Buffer Overflow2 CVEs

sources (1)

Which sources assert this record, and when.

EUEU Vulnerability Database (ENISA)85 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan