{"schema_version":1,"title":"Microsoft Exchange Server vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 52 vulnerabilities in Microsoft Exchange Server: 0 in the last 7 days and 16 in the last 90 days, 20 of them critical and 18 exploited in the wild. The most recent, CVE-2026-69641, was published on 8 September 2026.","url":"https://junglewise.ai/threats/technologies/exchange-server","json_url":"https://junglewise.ai/threats/technologies/exchange-server.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/exchange-server","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":19,"all_time":52,"critical":20,"exploited":18,"last_7_days":0,"last_30_days":9,"last_90_days":16,"last_365_days":30},"latest":[{"cve":"CVE-2026-69641","cvss":9.1,"epss":0.0086,"slug":"cve-2026-69641-microsoft-exchange-server-missing-authorization-allows-privilege","title":"Microsoft Exchange Server missing authorization allows privilege escalation","severity":"critical","exploited":false,"published_at":"2026-09-08T18:19:36.313+00:00","url":"https://junglewise.ai/threats/cve-2026-69641-microsoft-exchange-server-missing-authorization-allows-privilege"},{"cve":"CVE-2026-69382","cvss":5.9,"epss":0.0048,"slug":"cve-2026-69382-microsoft-exchange-server-weak-cryptography-information","title":"Microsoft Exchange Server weak cryptography information disclosure","severity":"medium","exploited":false,"published_at":"2026-09-08T18:18:59.11+00:00","url":"https://junglewise.ai/threats/cve-2026-69382-microsoft-exchange-server-weak-cryptography-information"},{"cve":"CVE-2026-69380","cvss":8.1,"epss":0.007,"slug":"cve-2026-69380-microsoft-exchange-server-privilege-escalation-over-network","title":"Microsoft Exchange Server privilege escalation over network","severity":"high","exploited":false,"published_at":"2026-09-08T18:18:58.803+00:00","url":"https://junglewise.ai/threats/cve-2026-69380-microsoft-exchange-server-privilege-escalation-over-network"},{"cve":"CVE-2026-69378","cvss":7.5,"epss":0.012,"slug":"cve-2026-69378-microsoft-exchange-server-uncontrolled-recursion-denial-of","title":"Microsoft Exchange Server uncontrolled recursion denial of service","severity":"high","exploited":false,"published_at":"2026-09-08T18:18:58.543+00:00","url":"https://junglewise.ai/threats/cve-2026-69378-microsoft-exchange-server-uncontrolled-recursion-denial-of"},{"cve":"CVE-2026-69375","cvss":6.5,"epss":0.0066,"slug":"cve-2026-69375-microsoft-exchange-server-authorization-bypass-via-user","title":"Microsoft Exchange Server authorization bypass via user-controlled key","severity":"medium","exploited":false,"published_at":"2026-09-08T18:18:58.057+00:00","url":"https://junglewise.ai/threats/cve-2026-69375-microsoft-exchange-server-authorization-bypass-via-user"},{"cve":"CVE-2026-69361","cvss":6.5,"epss":0.0086,"slug":"cve-2026-69361-microsoft-exchange-server-server-side-request-forgery","title":"Microsoft Exchange Server server-side request forgery","severity":"medium","exploited":false,"published_at":"2026-09-08T18:18:55.997+00:00","url":"https://junglewise.ai/threats/cve-2026-69361-microsoft-exchange-server-server-side-request-forgery"},{"cve":"CVE-2026-69356","cvss":9.3,"epss":0.0077,"slug":"cve-2026-69356-microsoft-exchange-server-cross-site-scripting-in-web-page","title":"Microsoft Exchange Server cross-site scripting in web page generation","severity":"critical","exploited":false,"published_at":"2026-09-08T18:18:55.06+00:00","url":"https://junglewise.ai/threats/cve-2026-69356-microsoft-exchange-server-cross-site-scripting-in-web-page"},{"cve":"CVE-2026-69355","cvss":8.8,"epss":0.0091,"slug":"cve-2026-69355-microsoft-exchange-server-external-control-of-file-name-or-path","title":"Microsoft Exchange Server external control of file name or path","severity":"high","exploited":false,"published_at":"2026-09-08T18:18:54.91+00:00","url":"https://junglewise.ai/threats/cve-2026-69355-microsoft-exchange-server-external-control-of-file-name-or-path"},{"cve":"CVE-2026-55007","cvss":8.1,"epss":0.0072,"slug":"cve-2026-55007-microsoft-exchange-server-double-free-vulnerability","title":"Microsoft Exchange Server double free vulnerability","severity":"high","exploited":false,"published_at":"2026-09-08T18:17:41.82+00:00","url":"https://junglewise.ai/threats/cve-2026-55007-microsoft-exchange-server-double-free-vulnerability"},{"cve":"CVE-2026-65813","cvss":6.5,"epss":0.0094,"slug":"cve-2026-65813-microsoft-exchange-server-ssrf-privilege-escalation","title":"Microsoft Exchange Server SSRF privilege escalation","severity":"medium","exploited":false,"published_at":"2026-08-11T17:19:00.847+00:00","url":"https://junglewise.ai/threats/cve-2026-65813-microsoft-exchange-server-ssrf-privilege-escalation"},{"cve":"CVE-2026-62915","cvss":6.5,"epss":0.0064,"slug":"cve-2026-62915-microsoft-exchange-server-missing-authorization-security-feature","title":"Microsoft Exchange Server missing authorization security feature bypass","severity":"medium","exploited":false,"published_at":"2026-08-11T17:18:45.57+00:00","url":"https://junglewise.ai/threats/cve-2026-62915-microsoft-exchange-server-missing-authorization-security-feature"},{"cve":"CVE-2026-62914","cvss":7.3,"epss":0.0045,"slug":"cve-2026-62914-microsoft-exchange-server-cross-site-scripting-in-web-page","title":"Microsoft Exchange Server cross-site scripting in web page generation","severity":"high","exploited":false,"published_at":"2026-08-11T17:18:45.447+00:00","url":"https://junglewise.ai/threats/cve-2026-62914-microsoft-exchange-server-cross-site-scripting-in-web-page"},{"cve":"CVE-2026-62913","cvss":8.8,"epss":0.0091,"slug":"cve-2026-62913-microsoft-exchange-server-heap-based-buffer-overflow","title":"Microsoft Exchange Server heap-based buffer overflow","severity":"high","exploited":false,"published_at":"2026-08-11T17:18:45.323+00:00","url":"https://junglewise.ai/threats/cve-2026-62913-microsoft-exchange-server-heap-based-buffer-overflow"},{"cve":"CVE-2026-62912","cvss":6.5,"epss":0.0198,"slug":"cve-2026-62912-microsoft-exchange-server-deserialization-vulnerability","title":"Microsoft Exchange Server deserialization vulnerability","severity":"medium","exploited":false,"published_at":"2026-08-11T17:18:45.197+00:00","url":"https://junglewise.ai/threats/cve-2026-62912-microsoft-exchange-server-deserialization-vulnerability"},{"cve":"CVE-2026-62910","cvss":7.2,"epss":0.01,"slug":"cve-2026-62910-microsoft-exchange-server-privilege-escalation-via-resource","title":"Microsoft Exchange Server privilege escalation via resource injection","severity":"high","exploited":false,"published_at":"2026-08-11T17:18:44.943+00:00","url":"https://junglewise.ai/threats/cve-2026-62910-microsoft-exchange-server-privilege-escalation-via-resource"},{"cve":"CVE-2026-55006","cvss":7.8,"slug":"cve-2026-55006-microsoft-exchange-server-privilege-escalation-via-insufficient","title":"Microsoft Exchange Server privilege escalation via insufficient access control","severity":"high","exploited":false,"published_at":"2026-07-14T17:17:08.65+00:00","url":"https://junglewise.ai/threats/cve-2026-55006-microsoft-exchange-server-privilege-escalation-via-insufficient"},{"cve":"CVE-2026-47631","cvss":8.1,"slug":"cve-2026-47631-microsoft-exchange-server-cross-site-scripting-spoofing","title":"Microsoft Exchange Server cross-site scripting spoofing vulnerability","severity":"high","exploited":false,"published_at":"2026-06-09T17:17:35.173+00:00","url":"https://junglewise.ai/threats/cve-2026-47631-microsoft-exchange-server-cross-site-scripting-spoofing"},{"cve":"CVE-2026-45583","cvss":7.5,"slug":"cve-2026-45583-microsoft-exchange-server-code-injection","title":"Microsoft Exchange Server code injection","severity":"high","exploited":false,"published_at":"2026-06-09T17:17:26.44+00:00","url":"https://junglewise.ai/threats/cve-2026-45583-microsoft-exchange-server-code-injection"},{"cve":"CVE-2026-45504","cvss":8.8,"slug":"cve-2026-45504-microsoft-exchange-server-privilege-escalation-via-ssrf","title":"Microsoft Exchange Server privilege escalation via SSRF","severity":"high","exploited":false,"published_at":"2026-06-09T17:17:26.257+00:00","url":"https://junglewise.ai/threats/cve-2026-45504-microsoft-exchange-server-privilege-escalation-via-ssrf"},{"cve":"CVE-2026-45503","cvss":8.1,"slug":"cve-2026-45503-microsoft-exchange-server-ssrf-in-server-component","title":"Microsoft Exchange Server SSRF in Server Component","severity":"high","exploited":false,"published_at":"2026-06-09T17:17:26.137+00:00","url":"https://junglewise.ai/threats/cve-2026-45503-microsoft-exchange-server-ssrf-in-server-component"},{"cve":"CVE-2026-45502","cvss":5,"slug":"cve-2026-45502-microsoft-exchange-server-ssrf-information-disclosure","title":"Microsoft Exchange Server SSRF information disclosure","severity":"medium","exploited":false,"published_at":"2026-06-09T17:17:26.01+00:00","url":"https://junglewise.ai/threats/cve-2026-45502-microsoft-exchange-server-ssrf-information-disclosure"},{"cve":"CVE-2026-45501","cvss":6.5,"slug":"cve-2026-45501-microsoft-exchange-server-xss-and-spoofing-vulnerability","title":"Microsoft Exchange Server XSS and spoofing vulnerability","severity":"medium","exploited":false,"published_at":"2026-06-09T17:17:25.88+00:00","url":"https://junglewise.ai/threats/cve-2026-45501-microsoft-exchange-server-xss-and-spoofing-vulnerability"},{"cve":"CVE-2026-45500","cvss":6.1,"slug":"cve-2026-45500-microsoft-exchange-server-cross-site-scripting","title":"Microsoft Exchange Server cross-site scripting","severity":"medium","exploited":false,"published_at":"2026-06-09T17:17:25.76+00:00","url":"https://junglewise.ai/threats/cve-2026-45500-microsoft-exchange-server-cross-site-scripting"},{"cve":"CVE-2026-42897","cvss":8.1,"epss":0.0022,"slug":"cve-2026-42897-microsoft-exchange-server-cross-site-scripting-in-outlook-web","title":"Microsoft Exchange Server cross-site scripting in Outlook Web Access","severity":"critical","exploited":true,"published_at":"2026-05-14T18:16:49.36+00:00","url":"https://junglewise.ai/threats/cve-2026-42897-microsoft-exchange-server-cross-site-scripting-in-outlook-web"},{"cve":"CVE-2023-21529","cvss":8.8,"epss":0.3178,"slug":"cve-2023-21529-microsoft-exchange-server-deserialization-remote-code-execution","title":"Microsoft Exchange Server deserialization remote code execution","severity":"critical","exploited":true,"published_at":"2026-04-13T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-21529-microsoft-exchange-server-deserialization-remote-code-execution"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-07","critical":2,"exploited":0,"vulnerabilities":9},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Microsoft Windows","slug":"windows-","vulnerabilities":963,"url":"https://junglewise.ai/threats/technologies/windows-"},{"name":"Microsoft Windows 10","slug":"windows-10","vulnerabilities":588,"url":"https://junglewise.ai/threats/technologies/windows-10"},{"name":"Microsoft Windows 11","slug":"windows-11","vulnerabilities":493,"url":"https://junglewise.ai/threats/technologies/windows-11"},{"name":"Microsoft Windows Server 2012","slug":"windows-server-2012","vulnerabilities":293,"url":"https://junglewise.ai/threats/technologies/windows-server-2012"},{"name":"Microsoft Windows Server 2016","slug":"windows-server-2016","vulnerabilities":213,"url":"https://junglewise.ai/threats/technologies/windows-server-2016"},{"name":"Microsoft Windows Server 2019","slug":"windows-server-2019","vulnerabilities":211,"url":"https://junglewise.ai/threats/technologies/windows-server-2019"},{"name":"Microsoft Windows 11 24h2","slug":"windows-11-24h2","vulnerabilities":192,"url":"https://junglewise.ai/threats/technologies/windows-11-24h2"},{"name":"Microsoft Windows Server 2022","slug":"windows-server-2022","vulnerabilities":178,"url":"https://junglewise.ai/threats/technologies/windows-server-2022"},{"name":"Microsoft Edge","slug":"edge-chromium-based","vulnerabilities":167,"url":"https://junglewise.ai/threats/technologies/edge-chromium-based"},{"name":"Microsoft Windows 11 25h2","slug":"windows-11-25h2","vulnerabilities":161,"url":"https://junglewise.ai/threats/technologies/windows-11-25h2"},{"name":"Microsoft Windows 11 Version 26H1","slug":"windows-11-version-26h1","vulnerabilities":135,"url":"https://junglewise.ai/threats/technologies/windows-11-version-26h1"},{"name":"Microsoft Windows Server 2025","slug":"windows-server-2025","vulnerabilities":124,"url":"https://junglewise.ai/threats/technologies/windows-server-2025"}],"technology":{"hub":true,"name":"Microsoft Exchange Server","slug":"exchange-server","vendor":{"name":"Microsoft","slug":"microsoft","url":"https://junglewise.ai/threats/vendors/microsoft"},"aliases":[],"category":"web-server","homepage":"https://www.microsoft.com/en-us/microsoft-365/exchange/email-server-software","description":"A mail server and calendaring server that runs on Windows Server operating systems.","url":"https://junglewise.ai/threats/technologies/exchange-server"},"most_severe":[{"cve":"CVE-2024-21410","cvss":9.8,"slug":"cve-2024-21410-microsoft-exchange-server-privilege-escalation-vulnerability","title":"Microsoft Exchange Server Privilege Escalation Vulnerability","severity":"critical","exploited":true,"published_at":"2024-02-15T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2024-21410-microsoft-exchange-server-privilege-escalation-vulnerability"},{"cve":"CVE-2022-41080","cvss":9.8,"slug":"cve-2022-41080-microsoft-exchange-server-privilege-escalation-vulnerability","title":"Microsoft Exchange Server Privilege Escalation Vulnerability","severity":"critical","exploited":true,"published_at":"2023-01-10T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2022-41080-microsoft-exchange-server-privilege-escalation-vulnerability"},{"cve":"CVE-2021-34473","cvss":9.8,"slug":"cve-2021-34473-microsoft-exchange-server-remote-code-execution-vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2021-34473-microsoft-exchange-server-remote-code-execution-vulnerability"},{"cve":"CVE-2021-34523","cvss":9.8,"slug":"cve-2021-34523-microsoft-exchange-server-privilege-escalation-vulnerability","title":"Microsoft Exchange Server Privilege Escalation Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2021-34523-microsoft-exchange-server-privilege-escalation-vulnerability"},{"cve":"CVE-2021-26855","cvss":9.8,"slug":"cve-2021-26855-microsoft-exchange-server-remote-code-execution-vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2021-26855-microsoft-exchange-server-remote-code-execution-vulnerability"},{"cve":"CVE-2023-21529","cvss":8.8,"epss":0.3178,"slug":"cve-2023-21529-microsoft-exchange-server-deserialization-remote-code-execution","title":"Microsoft Exchange Server deserialization remote code execution","severity":"critical","exploited":true,"published_at":"2026-04-13T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2023-21529-microsoft-exchange-server-deserialization-remote-code-execution"},{"cve":"CVE-2022-41040","cvss":8.8,"slug":"cve-2022-41040-microsoft-exchange-server-server-side-request-forgery","title":"Microsoft Exchange Server Server-Side Request Forgery Vulnerability","severity":"critical","exploited":true,"published_at":"2022-09-30T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2022-41040-microsoft-exchange-server-server-side-request-forgery"},{"cve":"CVE-2020-17144","cvss":8.8,"slug":"cve-2020-17144-microsoft-exchange-server-remote-code-execution-vulnerability","title":"Microsoft Exchange Server Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2020-17144-microsoft-exchange-server-remote-code-execution-vulnerability"},{"cve":"CVE-2020-0688","cvss":8.8,"slug":"cve-2020-0688-microsoft-exchange-server-validation-key-remote-code-execution","title":"Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability","severity":"critical","exploited":true,"published_at":"2021-11-03T00:00:00+00:00","url":"https://junglewise.ai/threats/cve-2020-0688-microsoft-exchange-server-validation-key-remote-code-execution"},{"cve":"CVE-2026-42897","cvss":8.1,"epss":0.0022,"slug":"cve-2026-42897-microsoft-exchange-server-cross-site-scripting-in-outlook-web","title":"Microsoft Exchange Server cross-site scripting in Outlook Web Access","severity":"critical","exploited":true,"published_at":"2026-05-14T18:16:49.36+00:00","url":"https://junglewise.ai/threats/cve-2026-42897-microsoft-exchange-server-cross-site-scripting-in-outlook-web"}],"generated_at":"2026-09-26T09:24:00.138874+00:00"}