Exchange Server

The US cybersecurity agency CISA lists these vulnerabilities in its catalog of Known Exploited Vulnerabilities. What CISA does not carry does not appear in this list — even where it is being exploited.

• CVE-2021-26855Microsoft Exchange Server Remote Code Execution VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 3 May 22

• CVE-2021-34473Microsoft Exchange Server Remote Code Execution VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 17 Nov 21

• CVE-2021-34523Microsoft Exchange Server Privilege Escalation VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 17 Nov 21

• CVE-2022-41080Microsoft Exchange Server Privilege Escalation VulnerabilityRansomware

  9.8 critical · over the network, without login · CISA deadline was 31 Jan 23

• CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution VulnerabilityRansomware

  8.8 high · over the network, with a basic account · CISA deadline was 3 May 22

• CVE-2022-41040Microsoft Exchange Server Server-Side Request Forgery VulnerabilityRansomware

  8.8 high · over the network, with a basic account · CISA deadline was 21 Oct 22

• CVE-2023-21529Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityRansomware

  8.8 high · over the network, with a basic account · CISA deadline was 27 Apr

• CVE-2022-41082Microsoft Exchange Server Remote Code Execution VulnerabilityRansomware

  8.0 high · from the local network, with a basic account · CISA deadline was 21 Oct 22

• CVE-2021-26857Microsoft Exchange Server Remote Code Execution VulnerabilityRansomware

  7.8 high · locally only, without login, needs user action · CISA deadline was 3 May 22

• CVE-2021-27065Microsoft Exchange Server Remote Code Execution VulnerabilityRansomware

  7.8 high · locally only, without login, needs user action · CISA deadline was 3 May 22

• CVE-2021-26858Microsoft Exchange Server Remote Code Execution VulnerabilityRansomware

  7.8 high · locally only, without login, needs user action · CISA deadline was 3 May 22

• CVE-2018-8581Microsoft Exchange Server Privilege Escalation VulnerabilityRansomware

  7.4 high · over the network, without login · CISA deadline was 17 Mar 22

• CVE-2021-31207Microsoft Exchange Server Security Feature Bypass VulnerabilityRansomware

  6.6 medium · over the network, with admin rights only · CISA deadline was 17 Nov 21

• CVE-2024-21410Microsoft Exchange Server Privilege Escalation Vulnerability

  9.8 critical · over the network, without login · CISA deadline was 7 Mar 24

• CVE-2020-17144Microsoft Exchange Server Remote Code Execution Vulnerability

  8.8 high · over the network, with a basic account · CISA deadline was 3 May 22

• CVE-2021-33766Microsoft Exchange Server Information Disclosure

  7.5 high · over the network, without login · CISA deadline was 1 Feb 22

• CVE-2021-31196Microsoft Exchange Server Information Disclosure Vulnerability

  7.2 high · over the network, with admin rights only · CISA deadline was 11 Sept 24

Source: CISA KEV. The CVE is matched to the product automatically — when in doubt, the linked NVD entry applies.