PatchTheCVEexchange server vulnerabilities and fixes
Recent CVEs affecting exchange server, with upgrade or downgrade steps. 11 tracked.
Also searched as: exchangeserver.
exchange server has 11 tracked vulnerabilities, 2 critical and 1 exploited in the wild (CISA KEV). A fixed release or vendor patch exists for 11. Most recent: 2026-10-02. Highest priority: CVE-2026-42897 (score 83/100).
- CVE-2026-42897 HIGH 8.1 EXPLOITED DOWNGRADE UPGRADE Microsoft Exchange Server Cross-Site Scripting Vulnerability
- CVE-2026-96940 HIGH 8.8 DOWNGRADE UPGRADE Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a ne
- CVE-2026-55007 HIGH 8.1 DOWNGRADE UPGRADE Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
- CVE-2026-69355 HIGH 8.8 DOWNGRADE UPGRADE External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute co
- CVE-2026-69356 CRITICAL 9.3 DOWNGRADE UPGRADE Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Ser
- CVE-2026-69361 MEDIUM 6.5 DOWNGRADE UPGRADE Server-side request forgery (ssrf) in Microsoft Exchange Server allows an authorized attacker to perform spoof
- CVE-2026-69375 MEDIUM 6.5 DOWNGRADE UPGRADE Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to
- CVE-2026-69378 HIGH 7.5 DOWNGRADE UPGRADE Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a net
- CVE-2026-69380 HIGH 8.1 DOWNGRADE UPGRADE Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a
- CVE-2026-69382 MEDIUM 5.9 DOWNGRADE UPGRADE Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker
- CVE-2026-69641 CRITICAL 9.1 DOWNGRADE UPGRADE Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a
FAQ
How do I fix exchange server vulnerabilities?
Open the CVE for your version, check the affected range, then follow the listed action: upgrade to the fixed release, or downgrade or mitigate if no fix exists yet. Commands for each OS are shown on every CVE page.
Is exchange server being exploited right now?
Yes: 1 exchange server CVE is on the CISA Known Exploited Vulnerabilities list, so patch it first.
Which exchange server CVE should I patch first?
CVE-2026-42897 currently ranks highest (83/100): Microsoft Exchange Server Cross-Site Scripting Vulnerability.