Class familyMicrosoft · Exchange Server
Microsoft Exchange Server SSRF flaws, 2021–2026
11 Exchange Server CVEs with CWE-918 weaknesses, 3 Mar 2021 to 8 Sep 2026. 3 are in CISA KEVThe US Cybersecurity and Infrastructure Security Agency’s list of Known Exploited Vulnerabilities. A CVE is added when CISA has evidence that attackers are using it..
CVEs by year
Published each year. Select a CVE to open it.Grouped by product and weakness type (CWE); not proven to share a root cause.
2 2021’21
1 2022’22
1 2023’23
2024’24
2025’25
7 2026’26
In CISA KEVNot in KEV
20212 CVEs, 2 in KEV
20221 CVE, 1 in KEV
20231 CVE
20267 CVEs
CVEs in this family
Table view of the years above| CVE | Published | Title | Linked from | Priority |
|---|---|---|---|---|
| CVE-2021-26855KEV | 3 Mar 2021 | Microsoft Exchange Server Remote Code Execution Vulnerability | Grouped by weakness | 89.4 |
| CVE-2021-34473KEV | 14 Jul 2021 | Microsoft Exchange Server Remote Code Execution Vulnerability | Grouped by weakness | 89.4 |
| CVE-2022-41040KEV | 3 Oct 2022 | Microsoft Exchange Server Server-Side Request Forgery Vulnerability | Grouped by weakness | 83.0 |
| CVE-2023-21761 | 10 Jan 2023 | Microsoft Exchange Server Information Disclosure Vulnerability | Grouped by weakness | 20.5 |
| CVE-2026-26137 | 19 Mar 2026 | Microsoft Exchange Elevation of Privilege Vulnerability | Grouped by weakness | 16.1 |
| CVE-2026-45501 | 9 Jun 2026 | Microsoft Exchange Server Spoofing Vulnerability | Grouped by weakness | 11.4 |
| CVE-2026-45502 | 9 Jun 2026 | Microsoft Exchange Server Information Disclosure Vulnerability | Grouped by weakness | 23.0 |
| CVE-2026-45504 | 9 Jun 2026 | Microsoft Exchange Server Elevation of Privilege Vulnerability | Grouped by weakness | 24.7 |
| CVE-2026-65813 | 11 Aug 2026 | Microsoft Exchange Server Elevation of Privilege Vulnerability | Grouped by weakness | 16.7 |
| CVE-2026-65801 | 20 Aug 2026 | Microsoft Exchange Online Elevation of Privilege Vulnerability | Grouped by weakness | 18.9 |
| CVE-2026-69361 | 8 Sep 2026 | Microsoft Exchange Server Spoofing Vulnerability | Grouped by weakness | 16.1 |