Exchange Server
by Microsoft
CVEs (233)
| CVE | Vendor / Product | Sev | Risk | CVSS | EPSS | KEV | Published | Description |
|---|---|---|---|---|---|---|---|---|
| CVE-2002-0049 | 0.01 | — | 0.13 | Mar 8, 2002 | Microsoft Exchange Server 2000 System Attendant gives "Everyone" group privileges to the WinReg key, which could allow remote attackers to read or modify registry keys. | |||
| CVE-2001-0726 | 0.01 | — | 0.16 | Dec 6, 2001 | Outlook Web Access (OWA) in Microsoft Exchange 5.5 Server, when used with Internet Explorer, does not properly detect certain inline script, which can allow remote attackers to perform arbitrary actions on a user's Exchange mailbox via an HTML e-mail message. | |||
| CVE-2001-0660 | 0.01 | — | 0.22 | Oct 30, 2001 | Outlook Web Access (OWA) in Microsoft Exchange 5.5, SP4 and earlier, allows remote attackers to identify valid user email addresses by directly accessing a back-end function that processes the global address list (GAL). | |||
| CVE-2001-0543 | 0.01 | — | 0.21 | Sep 20, 2001 | Memory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed posts. | |||
| CVE-2001-0509 | 0.01 | — | 0.17 | Sep 20, 2001 | Vulnerabilities in RPC servers in (1) Microsoft Exchange Server 2000 and earlier, (2) Microsoft SQL Server 2000 and earlier, (3) Windows NT 4.0, and (4) Windows 2000 allow remote attackers to cause a denial of service via malformed inputs. | |||
| CVE-2001-0340 | 0.01 | — | 0.06 | Jul 21, 2001 | An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically. | |||
| CVE-2000-1006 | 0.01 | — | 0.15 | Dec 11, 2000 | Microsoft Exchange Server 5.5 does not properly handle a MIME header with a blank charset specified, which allows remote attackers to cause a denial of service via a charset="" command, aka the "Malformed MIME Header" vulnerability. | |||
| CVE-2000-0524 | 0.01 | — | 0.15 | Jun 5, 2000 | Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email messages with blank fields such as BCC, Reply-To, Return-Path, or From. | |||
| CVE-1999-1043 | 0.01 | — | 0.13 | Dec 31, 1999 | Microsoft Exchange Server 5.5 and 5.0 does not properly handle (1) malformed NNTP data, or (2) malformed SMTP data, which allows remote attackers to cause a denial of service (application error). | |||
| CVE-1999-0993 | 0.01 | — | 0.07 | Dec 13, 1999 | Modifications to ACLs (Access Control Lists) in Microsoft Exchange 5.5 do not take effect until the directory store cache is refreshed. | |||
| CVE-1999-0385 | 0.01 | — | 0.18 | Dec 1, 1998 | The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduct a denial of service or execute commands. | |||
| CVE-1999-0007 | 0.01 | — | 0.08 | Jun 26, 1998 | Information from SSL-encrypted sessions via PKCS #1. | |||
| CVE-2026-26137 | 0.00 | — | 0.01 | Mar 19, 2026 | Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network. | |||
| CVE-2025-58107 | 0.00 | — | 0.00 | Mar 2, 2026 | In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password. | |||
| CVE-2024-49040 | 0.00 | — | 0.08 | Nov 12, 2024 | Microsoft Exchange Server Spoofing Vulnerability | |||
| CVE-2024-26198 | 0.00 | — | 0.07 | Mar 12, 2024 | Microsoft Exchange Server Remote Code Execution Vulnerability | |||
| CVE-2023-36035 | 0.00 | — | 0.87 | Nov 14, 2023 | Microsoft Exchange Server Spoofing Vulnerability | |||
| CVE-2023-36039 | 0.00 | — | 0.73 | Nov 14, 2023 | Microsoft Exchange Server Spoofing Vulnerability | |||
| CVE-2023-36050 | 0.00 | — | 0.39 | Nov 14, 2023 | Microsoft Exchange Server Spoofing Vulnerability | |||
| CVE-2023-36439 | 0.00 | — | 0.05 | Nov 14, 2023 | Microsoft Exchange Server Remote Code Execution Vulnerability |
- CVE-2002-0049Mar 8, 2002risk 0.01cvss —epss 0.13
Microsoft Exchange Server 2000 System Attendant gives "Everyone" group privileges to the WinReg key, which could allow remote attackers to read or modify registry keys.
- CVE-2001-0726Dec 6, 2001risk 0.01cvss —epss 0.16
Outlook Web Access (OWA) in Microsoft Exchange 5.5 Server, when used with Internet Explorer, does not properly detect certain inline script, which can allow remote attackers to perform arbitrary actions on a user's Exchange mailbox via an HTML e-mail message.
- CVE-2001-0660Oct 30, 2001risk 0.01cvss —epss 0.22
Outlook Web Access (OWA) in Microsoft Exchange 5.5, SP4 and earlier, allows remote attackers to identify valid user email addresses by directly accessing a back-end function that processes the global address list (GAL).
- CVE-2001-0543Sep 20, 2001risk 0.01cvss —epss 0.21
Memory leak in NNTP service in Windows NT 4.0 and Windows 2000 allows remote attackers to cause a denial of service (memory exhaustion) via a large number of malformed posts.
- CVE-2001-0509Sep 20, 2001risk 0.01cvss —epss 0.17
Vulnerabilities in RPC servers in (1) Microsoft Exchange Server 2000 and earlier, (2) Microsoft SQL Server 2000 and earlier, (3) Windows NT 4.0, and (4) Windows 2000 allow remote attackers to cause a denial of service via malformed inputs.
- CVE-2001-0340Jul 21, 2001risk 0.01cvss —epss 0.06
An interaction between the Outlook Web Access (OWA) service in Microsoft Exchange 2000 Server and Internet Explorer allows attackers to execute malicious script code against a user's mailbox via a message attachment that contains HTML code, which is executed automatically.
- CVE-2000-1006Dec 11, 2000risk 0.01cvss —epss 0.15
Microsoft Exchange Server 5.5 does not properly handle a MIME header with a blank charset specified, which allows remote attackers to cause a denial of service via a charset="" command, aka the "Malformed MIME Header" vulnerability.
- CVE-2000-0524Jun 5, 2000risk 0.01cvss —epss 0.15
Microsoft Outlook and Outlook Express allow remote attackers to cause a denial of service by sending email messages with blank fields such as BCC, Reply-To, Return-Path, or From.
- CVE-1999-1043Dec 31, 1999risk 0.01cvss —epss 0.13
Microsoft Exchange Server 5.5 and 5.0 does not properly handle (1) malformed NNTP data, or (2) malformed SMTP data, which allows remote attackers to cause a denial of service (application error).
- CVE-1999-0993Dec 13, 1999risk 0.01cvss —epss 0.07
Modifications to ACLs (Access Control Lists) in Microsoft Exchange 5.5 do not take effect until the directory store cache is refreshed.
- CVE-1999-0385Dec 1, 1998risk 0.01cvss —epss 0.18
The LDAP bind function in Exchange 5.5 has a buffer overflow that allows a remote attacker to conduct a denial of service or execute commands.
- CVE-1999-0007Jun 26, 1998risk 0.01cvss —epss 0.08
Information from SSL-encrypted sessions via PKCS #1.
- CVE-2026-26137Mar 19, 2026risk 0.00cvss —epss 0.01
Server-side request forgery (ssrf) in Microsoft Exchange allows an authorized attacker to elevate privileges over a network.
- CVE-2025-58107Mar 2, 2026risk 0.00cvss —epss 0.00
In Microsoft Exchange through 2019, Exchange ActiveSync (EAS) configurations on on-premises servers may transmit sensitive data from Samsung mobile devices in cleartext, including the user's name, e-mail address, device ID, bearer token, and base64-encoded password.
- CVE-2024-49040Nov 12, 2024risk 0.00cvss —epss 0.08
Microsoft Exchange Server Spoofing Vulnerability
- CVE-2024-26198Mar 12, 2024risk 0.00cvss —epss 0.07
Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2023-36035Nov 14, 2023risk 0.00cvss —epss 0.87
Microsoft Exchange Server Spoofing Vulnerability
- CVE-2023-36039Nov 14, 2023risk 0.00cvss —epss 0.73
Microsoft Exchange Server Spoofing Vulnerability
- CVE-2023-36050Nov 14, 2023risk 0.00cvss —epss 0.39
Microsoft Exchange Server Spoofing Vulnerability
- CVE-2023-36439Nov 14, 2023risk 0.00cvss —epss 0.05
Microsoft Exchange Server Remote Code Execution Vulnerability
Page 9 of 12