Microsoft Exchange Server 2016 Cumulative Update 23

productDE

cpe:/a:microsoft:exchange:server_2016_cumulative_update_23

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

critical

by severity

0critical17high5medium0low

updated 2026-10-26

vulnerabilities (276)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2026-21510US	—OT critical	24.5% (98th)	KEV	no fix	2026-02-10	—
CVE-2026-21533US	—OT critical	4.15% (91st)	KEV	no fix	2026-02-10	—
CVE-2026-42897US	medium6.1OT critical	0.52% (43rd)	KEV	no fix	2026-05-14	—
CVE-2026-68820US	—OT critical	0.33% (25th)	KEV	no fix	2026-08-11	—
CVE-2026-21513US	—OT critical	15.9% (97th)	KEV	no fix	2026-02-10	—
CVE-2026-21525US	—OT critical	4.83% (92nd)	KEV	no fix	2026-02-10	—
CVE-2026-21519US	—OT critical	2.48% (84th)	KEV	no fix	2026-02-10	—
CVE-2026-21248US	—	1.33% (71st)	Exploit	no fix	2026-02-10	—
CVE-2026-21244US	—	1.33% (71st)	Exploit	no fix	2026-02-10	—
CVE-2026-21250US	—	1.11% (66th)	Exploit	no fix	2026-02-10	—
CVE-2026-62878US	—	0.97% (62nd)	Exploit	no fix	2026-08-11	—
CVE-2026-49179US	—	0.86% (58th)	Exploit	no fix	2026-08-11	—
CVE-2026-62911US	—OT elevated	0.69% (52nd)	Exploit	no fix	2026-08-11	—
CVE-2026-96940US	high8.8	0.48% (41st)	Exploit	no fix	2026-10-02	—
CVE-2026-54984US	—	0.47% (39th)	Exploit	no fix	2026-08-11	—
CVE-2026-21508US	high7.0	0.45% (38th)	Exploit	no fix	2026-02-10	—
CVE-2026-62737US	—	0.33% (25th)	Exploit	no fix	2026-08-11	—
CVE-2026-62735US	—	0.33% (25th)	Exploit	no fix	2026-08-11	—
CVE-2026-66804US	—	0.30% (21st)	Exploit	no fix	2026-08-11	—
CVE-2026-21249US	—	11.4% (96th)	—	no fix	2026-02-10	—
CVE-2026-21527US	—OT elevated	8.26% (95th)	—	no fix	2026-02-10	—
CVE-2026-21238US	—	3.38% (89th)	—	no fix	2026-02-10	—
CVE-2026-21241US	—	2.60% (85th)	—	no fix	2026-02-10	—
CVE-2026-21231US	—	2.56% (85th)	—	no fix	2026-02-10	—
CVE-2026-62912US	—	1.98% (80th)	—	no fix	2026-08-11	—
CVE-2026-59124US	—	1.53% (75th)	—	no fix	2026-08-11	—
CVE-2026-21243US	—	1.43% (73rd)	—	no fix	2026-02-10	—
CVE-2026-20846US	—	1.43% (73rd)	—	no fix	2026-02-10	—
CVE-2023-2804US	medium6.5	1.20% (68th)	—	no fix	2023-05-25	—
CVE-2026-65681US	—	1.17% (67th)	—	no fix	2026-08-11	—
CVE-2026-59132US	—	1.17% (67th)	—	no fix	2026-08-11	—
CVE-2026-54113US	—	1.17% (67th)	—	no fix	2026-08-11	—
CVE-2026-61345US	—	1.14% (66th)	—	no fix	2026-08-11	—
CVE-2026-59138US	—	1.14% (66th)	—	no fix	2026-08-11	—
CVE-2026-55005US	—	1.01% (63rd)	—	no fix	2026-07-14	—
CVE-2026-62910US	high8.8	1.00% (63rd)	—	no fix	2026-08-11	—
CVE-2026-62702US	high8.6	0.98% (62nd)	—	no fix	2026-08-11	—
CVE-2026-68819US	high7.5	0.98% (62nd)	—	no fix	2026-08-11	—
CVE-2026-65791US	—	0.97% (62nd)	—	no fix	2026-08-11	—
CVE-2026-62893US	—	0.97% (62nd)	—	no fix	2026-08-11	—
CVE-2026-62815US	—	0.97% (62nd)	—	no fix	2026-08-11	—
CVE-2026-65813US	high8.8	0.94% (61st)	—	no fix	2026-08-11	—
CVE-2026-62782US	high7.5	0.92% (60th)	—	no fix	2026-08-11	—
CVE-2026-61924US	high7.5	0.92% (60th)	—	no fix	2026-08-11	—
CVE-2026-61918US	high7.5	0.92% (60th)	—	no fix	2026-08-11	—
CVE-2026-65794US	—	0.92% (60th)	—	no fix	2026-08-11	—
CVE-2026-61921US	—	0.92% (60th)	—	no fix	2026-08-11	—
CVE-2026-62913US	—	0.91% (60th)	—	no fix	2026-08-11	—
CVE-2026-62818US	—	0.91% (60th)	—	no fix	2026-08-11	—
CVE-2026-62800US	—	0.91% (60th)	—	no fix	2026-08-11	—

showing 50 of 276

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-122Heap-based Buffer Overflow83 CVEs
CWE-416Use After Free62 CVEs
CWE-125Out-of-bounds Read29 CVEs
CWE-362Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')20 CVEs
CWE-190Integer Overflow or Wraparound10 CVEs
CWE-191Integer Underflow (Wrap or Wraparound)10 CVEs
CWE-59Improper Link Resolution Before File Access ('Link Following')10 CVEs
CWE-121Stack-based Buffer Overflow8 CVEs

sources (1)

Which sources assert this record, and when.

DECERT-Bund (BSI CSAF)276 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan