Fixes 8 records
Priority MEDIUM 43
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1CRITICAL 9.1· Network · High privileges · No interaction · EPSS 0.00862 · Published 2026-09-08 · Fixed in 15.01.2507.073, 15.02.1544.046 +2 CWE-862
Priority MEDIUM 43
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVSS 3.1CRITICAL 9.3· Network · No auth · User interaction · EPSS 0.00756 · Published 2026-09-08 · Fixed in 15.01.2507.073, 15.02.1544.046 +2 CWE-79
Priority MEDIUM 42
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
CVSS 3.1HIGH 8.8· Network · Low privileges · No interaction · EPSS 0.00913 · Published 2026-09-08 · Fixed in 15.01.2507.073, 15.02.1544.046 +2 CWE-73
Priority LOW 38
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVSS 3.1HIGH 8.1· Network · Low privileges · No interaction · EPSS 0.00689 · Published 2026-09-08 · Fixed in 15.01.2507.073, 15.02.1544.046 +2 CWE-862
Priority LOW 35
Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.01174 · Published 2026-09-08 · Fixed in 15.01.2507.073, 15.02.1544.046 +2 CWE-674
Priority LOW 30
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.00644 · Published 2026-09-08 · Fixed in 15.01.2507.073, 15.02.1544.046 +2 CWE-639
Priority LOW 30
Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
CVSS 3.1MEDIUM 6.5· Network · Low privileges · No interaction · EPSS 0.0084 · Published 2026-09-08 · Fixed in 15.01.2507.073, 15.02.1544.046 +2 CWE-918
Priority LOW 27
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
CVSS 3.1MEDIUM 5.9· Network · No auth · No interaction · EPSS 0.00471 · Published 2026-09-08 · Fixed in 15.01.2507.073, 15.02.1544.046 +2 CWE-327
THREATIST.IORead the docs