Class familyMicrosoft · Exchange Server
Microsoft Exchange Server input validation flaws, 2021–2025
5 Exchange Server CVEs with CWE-20 weaknesses, 11 May 2021 to 9 Dec 2025. 1 is in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2021’21
2022’22
1 2023’23
2024’24
3 2025’25
In CISA KEVNot in KEV
20211 CVE, 1 in KEV
20231 CVE
20253 CVEs
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2021-31207KEV | 11 May 2021 | Microsoft Exchange Server Security Feature Bypass Vulnerability | Grouped by weakness | 87.6 |
| CVE-2023-35368 | 8 Aug 2023 | Microsoft Exchange Remote Code Execution Vulnerability | Grouped by weakness | 23.1 |
| CVE-2025-25005 | 12 Aug 2025 | Microsoft Exchange Server Tampering Vulnerability | Grouped by weakness | 19.1 |
| CVE-2025-59248 | 14 Oct 2025 | Microsoft Exchange Server Spoofing Vulnerability | Grouped by weakness | 17.9 |
| CVE-2025-64666 | 9 Dec 2025 | Microsoft Exchange Server Elevation of Privilege Vulnerability | Grouped by weakness | 17.9 |