Class familyMicrosoft · Exchange Server
Microsoft Exchange Server authentication bypass flaws, 2020–2026
5 Exchange Server CVEs with CWE-287 weaknesses, 11 Feb 2020 to 24 Jul 2026. 4 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
1 2020’20
2 2021’21
2022’22
2023’23
1 2024’24
2025’25
1 2026’26
In CISA KEVNot in KEV
20201 CVE, 1 in KEV
20212 CVEs, 2 in KEV
20241 CVE, 1 in KEV
20261 CVE
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2020-0688KEV | 11 Feb 2020 | Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability | Grouped by weakness | 86.9 |
| CVE-2021-33766KEV | 14 Jul 2021 | Microsoft Exchange Server Information Disclosure | Grouped by weakness | 68.1 |
| CVE-2021-34523KEV | 14 Jul 2021 | Microsoft Exchange Server Privilege Escalation Vulnerability | Grouped by weakness | 89.3 |
| CVE-2024-21410KEV | 13 Feb 2024 | Microsoft Exchange Server Privilege Escalation Vulnerability | Grouped by weakness | 64.1 |
| CVE-2026-56191 | 24 Jul 2026 | Microsoft Exchange Online Tampering Vulnerability | Grouped by weakness | 18.9 |