Microsoft Exchange Server known exploited vulnerabilities
We track 19 CVEs in Microsoft Exchange Server. 18 of them are on CISA's Known Exploited Vulnerabilities catalog, meaning CISA has evidence of exploitation in the wild (listed 2021–2021). CISA flags 14 of them as used in ransomware campaigns. The most recent is CVE-2026-96940.
Also listed as: Exchange. CISA, NVD and vendor advisories name the same product differently; each CVE page keeps the wording from its source.
- CVEs tracked
- 19
- On CISA KEV
- 18
- Ransomware use
- 14
- Rated critical
- 4
Every Microsoft Exchange Server CVE we track
| CVE / Vulnerability | Severity | CVSS | EPSS | Added to KEV | Patch by |
|---|---|---|---|---|---|
| CVE-2026-96940 Microsoft Exchange Server privilege escalation via weak authorizationwrite-up | [ HIGH ] | 8.8 | 0.5% | — | — |
| CVE-2023-21529 Microsoft Exchange Server Deserialization of Untrusted Data Vulnerabilityransomware use | [ HIGH ] | 8.8 | 59.3% | ||
| CVE-2021-31196 Microsoft Exchange Server Information Disclosure Vulnerability | [ HIGH ] | 7.2 | 54.1% | ||
| CVE-2024-21410 Microsoft Exchange Server Privilege Escalation Vulnerability | [ CRITICAL ] | 9.8 | 12.6% | ||
| CVE-2022-41080 Microsoft Exchange Server Privilege Escalation Vulnerabilityransomware use | [ HIGH ] | 8.8 | 77.3% | ||
| CVE-2022-41082 Microsoft Exchange Server Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 8.0 | 100.0% | ||
| CVE-2022-41040 Microsoft Exchange Server Server-Side Request Forgery Vulnerabilityransomware use | [ HIGH ] | 8.8 | 100.0% | ||
| CVE-2018-8581 Microsoft Exchange Server Privilege Escalation Vulnerabilityransomware use | [ HIGH ] | 7.4 | 27.4% | ||
| CVE-2021-33766 Microsoft Exchange Server Information Disclosure | [ HIGH ] | 7.3 | 98.2% | ||
| CVE-2021-42321 Microsoft Exchange Server Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 8.8 | 91.7% | ||
| CVE-2021-34523 Microsoft Exchange Server Privilege Escalation Vulnerabilityransomware use | [ CRITICAL ] | 9.0 | 100.0% | ||
| CVE-2021-34473 Microsoft Exchange Server Remote Code Execution Vulnerabilityransomware use | [ CRITICAL ] | 9.1 | 100.0% | ||
| CVE-2021-31207 Microsoft Exchange Server Security Feature Bypass Vulnerabilityransomware use | [ MEDIUM ] | 6.6 | 99.8% | ||
| CVE-2021-27065 Microsoft Exchange Server Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 7.8 | 99.9% | ||
| CVE-2021-26858 Microsoft Exchange Server Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 7.8 | 93.7% | ||
| CVE-2021-26857 Microsoft Exchange Server Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 7.8 | 95.8% | ||
| CVE-2021-26855 ProxyLogon — Microsoft Exchange Server Server-Side Request Forgeryransomware usewrite-up | [ CRITICAL ] | 9.8 | 100.0% | ||
| CVE-2020-17144 Microsoft Exchange Server Remote Code Execution Vulnerability | [ HIGH ] | 8.4 | 36.5% | ||
| CVE-2020-0688 Microsoft Exchange Server Validation Key Remote Code Execution Vulnerabilityransomware use | [ HIGH ] | 8.8 | 100.0% |
Sorted by date added to KEV. Severity and CVSS as stated by NVD or the vendor; EPSS from FIRST.org. "Patch by" is CISA's BOD 22-01 deadline for US federal agencies, a useful priority signal for everyone else. Machine-readable: /api/v1/vendors/microsoft.json.
Our Microsoft Exchange Server coverage
Other Microsoft products
Every row links to its CVE record with the CISA required action, catalog coverage and primary sources. We describe impact and remediation only; no exploit code. See the full KEV tracker or compare KEV catalogs.