Fixes 11 records
Priority MEDIUM 44
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1CRITICAL 9.6· Network · No auth · User interaction · EPSS 0.00863 · Published 2026-07-14 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-79
Priority MEDIUM 43
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0133 · Published 2026-06-09 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-918
Priority MEDIUM 42
Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.0101 · Published 2026-07-14 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-122
Priority MEDIUM 41
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.02513 · Published 2026-07-14 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-502
Priority MEDIUM 41
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 5.0· Network · Low privileges · No interaction · EPSS 0.19636 · Published 2026-06-09 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-918
Priority LOW 38
Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
CVSS 3.1HIGH 8.1· Network · No auth · No interaction · EPSS 0.00522 · Published 2026-06-09 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-94
Priority LOW 38
Improper authorization in Microsoft Exchange Server allows an authorized attacker to disclose information over a network.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00445 · Published 2026-06-09 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-285
Priority LOW 37
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1HIGH 8.1· Network · No auth · User interaction · EPSS 0.00353 · Published 2026-06-09 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-79
Priority LOW 36
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
CVSS 3.1HIGH 7.8· Local · Low privileges · No interaction · EPSS 0.00298 · Published 2026-07-14 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-1220
Priority LOW 29
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00402 · Published 2026-06-09 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-918
Priority LOW 27
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.00375 · Published 2026-06-09 · Fixed in 15.01.2507.071, 15.02.1544.043 +2 CWE-79
THREATIST.IORead the docs