microsoft exchange server

Name: microsoft exchange server
Brand: microsoft

productUS

cpe:2.3:a:microsoft:exchange_server:*:*:*:*:*:*:*:*

A product tracked in the threat graph; the vulnerabilities below are known to affect it.

by severity

7critical64high124medium7low

updated 2026-10-27

vulnerabilities (258)

Related CVEs.

sort

ID	severity	EPSS	exploitable	patched	published	affected
CVE-2021-34473US	high10.0OT critical	100.0% (100th)	KEV	no fix	2021-07-14	3 versions
CVE-2021-26855US	high7.5OT critical	100.0% (100th)	KEV	no fix	2021-03-03	3 versions
CVE-2021-34523US	high7.5OT critical	100.0% (100th)	KEV	no fix	2021-07-14	3 versions
CVE-2022-41082US	—OT critical	100.0% (100th)	KEV	no fix	2022-10-03	3 versions
CVE-2020-0688US	high8.8OT critical	100.0% (100th)	KEV	no fix	2020-02-11	4 versions
CVE-2022-41040US	—OT critical	100.0% (100th)	KEV	no fix	2022-10-03	3 versions
CVE-2021-27065US	medium6.8OT critical	99.9% (100th)	KEV	no fix	2021-03-03	3 versions
CVE-2021-31207US	medium6.5OT critical	99.8% (100th)	KEV	no fix	2021-05-11	3 versions
CVE-2021-33766US	medium5.0OT critical	98.2% (100th)	KEV	no fix	2021-07-14	3 versions
CVE-2021-26857US	medium6.8OT critical	95.8% (100th)	KEV	no fix	2021-03-03	4 versions
CVE-2021-42321US	medium6.5OT critical	91.7% (100th)	KEV	no fix	2021-11-10	2 versions
CVE-2022-41080US	—OT critical	77.3% (100th)	KEV	no fix	2022-11-09	3 versions
CVE-2017-8540US	high7.8OT critical	71.9% (99th)	KEV	no fix	2017-05-26	2 versions
CVE-2026-42897US	medium6.1OT critical	70.7% (99th)	KEV	no fix	2026-05-14	2 versions
CVE-2020-17144US	medium6.0OT critical	36.5% (98th)	KEV	no fix	2020-12-10	= 2010
CVE-2018-8581US	high7.4OT critical	27.4% (98th)	KEV	no fix	2018-11-14	4 versions
CVE-2024-21410US	—OT critical	12.7% (96th)	KEV	no fix	2024-02-13	2 versions
CVE-2021-26858US	medium6.8OT critical	93.7% (100th)	KEV	no fix	2021-03-03	3 versions
CVE-2023-21529US	—OT critical	59.3% (99th)	KEV	no fix	2023-02-14	3 versions
CVE-2021-31196US	medium6.5OT critical	54.1% (99th)	KEV	no fix	2021-07-14	3 versions
CVE-2021-41349US	medium4.3	93.5% (100th)	Exploit	no fix	2021-11-10	3 versions
CVE-2020-17132US	medium6.5	89.9% (100th)	Exploit	no fix	2020-12-10	3 versions
CVE-2021-28482US	high9.0	83.2% (100th)	Exploit	no fix	2021-04-13	3 versions
CVE-2023-21707US	—	82.0% (100th)	Exploit	no fix	2023-02-14	3 versions
CVE-2023-32031US	—	81.5% (100th)	Exploit	no fix	2023-06-14	2 versions
CVE-2006-0027US	high7.5	78.7% (100th)	Exploit	no fix	2006-05-10	2 versions
CVE-2003-0714US	high7.5	77.6% (100th)	Exploit	no fix	2003-11-17	2 versions
CVE-2023-36745US	—	76.2% (100th)	Exploit	no fix	2023-09-12	2 versions
CVE-2021-28480US	high10.0	71.2% (99th)	Exploit	no fix	2021-04-13	3 versions
CVE-2005-0560US	high7.5	69.5% (99th)	Exploit	no fix	2005-05-02	2 versions
CVE-2004-0574US	high10.0	67.8% (99th)	Exploit	no fix	2004-11-03	2 versions
CVE-2007-0213US	high10.0	66.2% (99th)	Exploit	no fix	2007-05-08	3 versions
CVE-2018-0986US	high8.8	63.3% (99th)	Exploit	no fix	2018-04-04	2 versions
CVE-2008-1547US	medium4.3	48.1% (99th)	Exploit	no fix	2008-10-21	= 2003
CVE-2020-16875US	high9.0	46.5% (99th)	Exploit	no fix	2020-09-11	2 versions
CVE-2022-23277US	medium6.5	41.1% (99th)	Exploit	no fix	2022-03-09	3 versions
CVE-2006-1193US	low2.6	39.8% (99th)	Exploit	no fix	2006-06-13	= 2000
CVE-2002-1790US	medium5.0	34.0% (98th)	Exploit	no fix	2002-12-31	= 5.5
CVE-2005-0420US	medium5.8	25.6% (98th)	Exploit	no fix	2005-04-27	= 2003
CVE-2019-0724US	high8.1	23.8% (98th)	Exploit	no fix	2019-03-05	4 versions
CVE-2010-2091US	medium4.3	17.9% (97th)	Exploit	no fix	2010-05-27	= 2007
CVE-2017-8537US	medium5.5	16.8% (97th)	Exploit	no fix	2017-05-26	2 versions
CVE-2017-8536US	medium5.5	16.8% (97th)	Exploit	no fix	2017-05-26	2 versions
CVE-2017-8535US	medium5.5	16.8% (97th)	Exploit	no fix	2017-05-26	2 versions
CVE-1999-0284US	high7.5	11.5% (96th)	Exploit	no fix	1998-01-01	2 versions
CVE-2025-53786US	—	7.59% (95th)	Exploit	no fix	2025-08-06	2 versions
CVE-2021-24085US	medium6.0	4.63% (92nd)	Exploit	no fix	2021-02-25	2 versions
CVE-2021-34470US	medium5.2	4.38% (91st)	Exploit	no fix	2021-07-14	3 versions
CVE-2026-96940US	high8.8	2.75% (86th)	Exploit	no fix	2026-10-02	2 versions
CVE-2026-45504US	—	1.18% (68th)	Exploit	no fix	2026-06-09	2 versions

showing 50 of 258

weaknesses (8)

The flaw types (CWEs) most of these CVEs share.

CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')44 CVEs
CWE-20Improper Input Validation40 CVEs
CWE-502Deserialization of Untrusted Data27 CVEs
CWE-94Improper Control of Generation of Code ('Code Injection')24 CVEs
CWE-200Exposure of Sensitive Information to an Unauthorized Actor22 CVEs
CWE-264CWE-26416 CVEs
CWE-119Improper Restriction of Operations within the Bounds of a Memory Buffer11 CVEs
CWE-284Improper Access Control11 CVEs

sources (1)

Which sources assert this record, and when.

USNVD / CVE258 CVEs

scry

Products carry known vulnerabilities once they are exposed to the internet. See what is exposed on your perimeter with a free passive scan.

Free scan