Advisories · Technology

Microsoft Exchange Server 2019.

Every CVE that names Microsoft Exchange Server 2019 among its affected products, newest first. Vendors and products are as the CNA wrote them; check the affected versions on each record.

CVE-2021-27065 CVE record

CVSS 7.8 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware

Microsoft Exchange Server Remote Code Execution Vulnerability
- Microsoft Exchange Server 2013 Cumulative Update 21
- Microsoft Exchange Server 2013 Cumulative Update 22
- Path traversal
Not analysed yet 2 Mar 2021
CVE-2021-26858 CVE record

CVSS 7.8 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware

Microsoft Exchange Server Remote Code Execution Vulnerability
- Microsoft Exchange Server 2013 Cumulative Update 21
- Microsoft Exchange Server 2013 Cumulative Update 22
Not analysed yet 2 Mar 2021
CVE-2021-26857 CVE record

CVSS 7.8 HighCritical · KEV, CVSS 7+ and EPSSKEV · ransomware

Microsoft Exchange Server Remote Code Execution Vulnerability
- Microsoft Exchange Server 2010 Service Pack 3
- Microsoft Exchange Server 2013 Cumulative Update 21
- Insecure deserialization
Not analysed yet 2 Mar 2021
CVE-2021-26855 CVE record

CVSS 9.1 CriticalCritical · KEV, CVSS 9+, CVSS 7+ and EPSSKEV · ransomware

Microsoft Exchange Server Remote Code Execution Vulnerability
- Microsoft Exchange Server 2013 Cumulative Update 21
- Microsoft Exchange Server 2013 Cumulative Update 22
- Server-side request forgery (SSRF)
Not analysed yet 2 Mar 2021
CVE-2019-1373 CVE record

A remote code execution vulnerability exists in Microsoft Exchange through the deserialization of metadata via PowerShell, aka 'Microsoft Exchange Remote Code Execution Vulnerability'.
- Microsoft Exchange Server 2019
- Microsoft Exchange Server 2016
Not analysed yet 12 Nov 2019
CVE-2019-1266 CVE record

A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web App (OWA) fails to properly handle web requests, aka 'Microsoft Exchange Spoofing Vulnerability'.
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2019
Not analysed yet 11 Sept 2019
CVE-2019-1233 CVE record

A denial of service vulnerability exists in Microsoft Exchange Server software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Denial of Service Vulnerability'.
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2019
Not analysed yet 11 Sept 2019
CVE-2019-1137 CVE record

A cross-site-scripting (XSS) vulnerability exists when Microsoft Exchange Server does not properly sanitize a specially crafted web request to an affected Exchange server, aka 'Microsoft Exchange Ser…
- Microsoft Exchange Server 2016
- Microsoft Exchange Server 2019
Not analysed yet 29 Jul 2019
CVE-2019-1084 CVE record

An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having non-printable characters.
- Microsoft Exchange Server
- Microsoft Outlook
Not analysed yet 15 Jul 2019
CVE-2019-0858 CVE record

Microsoft Exchange Server: A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access…
- Microsoft Exchange Server
- Microsoft Exchange Server 2016
Not analysed yet 9 Apr 2019
CVE-2019-0817 CVE record

Microsoft Exchange Server: A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access…
- Microsoft Exchange Server
- Microsoft Exchange Server 2016
Not analysed yet 9 Apr 2019
CVE-2019-0724 CVE record

An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.
- Microsoft Exchange Server 2010
- Microsoft Exchange Server 2013
Not analysed yet 6 Mar 2019
CVE-2019-0686 CVE record

An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of Privilege Vulnerability'.
- Microsoft Exchange Server 2010
- Microsoft Exchange Server 2013
Not analysed yet 6 Mar 2019