CyberSIXT Search
Microsoft product

Exchange Server

← All Microsoft products

No CISA KEV deadline is open. CISA last added a Exchange Server CVE on 13 Apr.

Tracked since 7 Apr · latest article Tue 6 Oct · RSS

High exploit odds · current
0
high · not in KEV

Exploited, by due date

CSV download
CVEProductAddedDue · federal deadline

Deadlines passed

CVE-2023-21529Exchange Server13 AprDeadline passed 27 AprRansomware: Known · 7 articles
CVE-2021-31196not in CyberSIXT coverageExchange Server21 Aug 2024Deadline passed 11 Sep 2024Ransomware: Unknown · 0 articles
CVE-2024-21410not in CyberSIXT coverageExchange Server15 Feb 2024Deadline passed 7 Mar 2024Ransomware: Unknown · 0 articles
CVE-2022-41080not in CyberSIXT coverageExchange Server10 Jan 2023Deadline passed 31 Jan 2023Ransomware: Known · 0 articles
CVE-2022-41040not in CyberSIXT coverageExchange Server30 Sep 2022Deadline passed 21 Oct 2022Ransomware: Known · 0 articles
CVE-2022-41082not in CyberSIXT coverageExchange Server30 Sep 2022Deadline passed 21 Oct 2022Ransomware: Known · 0 articles
CVE-2018-8581not in CyberSIXT coverageExchange Server3 Mar 2022Deadline passed 17 Mar 2022Ransomware: Known · 0 articles
CVE-2021-33766not in CyberSIXT coverageExchange Server18 Jan 2022Deadline passed 1 Feb 2022Ransomware: Unknown · 0 articles
CVE-2021-31207not in CyberSIXT coverageExchange Server3 Nov 2021Deadline passed 17 Nov 2021Ransomware: Known · 0 articles
CVE-2021-34473not in CyberSIXT coverageExchange Server3 Nov 2021Deadline passed 17 Nov 2021Ransomware: Known · 0 articles
7 earlier entries
CVE-2021-34523not in CyberSIXT coverageExchange Server3 Nov 2021Deadline passed 17 Nov 2021Ransomware: Known · 0 articles
CVE-2020-0688Exchange Server3 Nov 2021Deadline passed 3 May 2022Ransomware: Known · 1 article
CVE-2020-17144not in CyberSIXT coverageExchange Server3 Nov 2021Deadline passed 3 May 2022Ransomware: Unknown · 0 articles
CVE-2021-26855not in CyberSIXT coverageExchange Server3 Nov 2021Deadline passed 3 May 2022Ransomware: Known · 0 articles
CVE-2021-26857not in CyberSIXT coverageExchange Server3 Nov 2021Deadline passed 3 May 2022Ransomware: Known · 0 articles
CVE-2021-26858not in CyberSIXT coverageExchange Server3 Nov 2021Deadline passed 3 May 2022Ransomware: Known · 0 articles
CVE-2021-27065not in CyberSIXT coverageExchange Server3 Nov 2021Deadline passed 3 May 2022Ransomware: Known · 0 articles

Coverage

20 articles · all timeFull timeline →

20 articles from 8 outlets since 7 Apr; the latest 20 days ago.

Exchange Server: coverage over time20 articles from 8 outlets. First report 7 Apr by The Hacker News. Busiest week: 5 articles, week of 7 Sep. 0 in the last 7 days. Exchange Server: coverage over time20 articles from 8 outlets. First report 7 Apr by The Hacker News. Busiest week: 5 articles, week of 7 Sep. 0 in the last 7 days.
  • Article
  • First report
  • Official notice
Show as table
Exchange Server: articles
Published (UTC)OutletHeadline
Tue 6 Oct · 14:27 UTCSecurity AffairsMicrosoft Patches Exchange Flaw That Could Expose Staff Mailboxes
Mon 5 Oct · 17:58 UTCThe Hacker NewsMicrosoft Patches Exchange Flaw That Exposes Colleagues’ Mailboxes
Sat 3 Oct · 03:00 UTCSecurityOnlineMicrosoft Reissues Exchange Updates With New CVE-2026-96940 Flaw
Mon 21 Sep · 09:13 UTCSecurityOnlineNightEagle Hackers Target Russian Firms With GhostContainer Backdoor
Wed 9 Sep · 07:37 UTCSecurity AffairsMicrosoft Fixes Nearly 1,000 Flaws in Record Patch Tuesday Update
Tue 8 Sep · 22:00 UTCDark ReadingMicrosoft Fixes 974 Flaws as Two Windows Zero Days Face Exploitation
Tue 8 Sep · 21:30 UTCArs TechnicaMicrosoft’s Record 972-Flaw Patch Haul Includes Two Zero-Days
Tue 8 Sep · 19:47 UTCSecurityWeekMicrosoft Fixes 974 Flaws in Record Patch Tuesday Update
Mon 7 Sep · 04:31 UTCSecurityOnlineMicrosoft to Block Outdated Exchange Servers from Cloud Email
Fri 4 Sep · 16:52 UTCSecurityWeekMicrosoft Patches Nine Cloud Flaws as Exchange Attacks Intensify
Tue 1 Sep · 02:41 UTCSecurityOnlineExchange flaw lets attackers run code as SYSTEM via NTLM relay.
Wed 26 Aug · 10:21 UTCSecurelistAI driven software surge fuels record Q2 2026 vulnerability spike
Fri 3 Jul · 01:31 UTCSecurityOnlineCVE-2026-45504: Exchange flaw lets low-priv users read files
Tue 14 Apr · 09:17 UTCSecurityWeekOrganizations Warned of Exploited Windows, Adobe Acrobat Vulnerabilities
Tue 14 Apr · 08:11 UTCSecurity AffairsCISA Adds Critical Adobe, Microsoft, Fortinet Flaws to KEV Catalog
Tue 14 Apr · 06:31 UTCThe Hacker NewsCISA adds six KEV flaws amid active Fortinet exploits
Mon 13 Apr · 22:05 UTCCISACISA adds Microsoft Exchange flaw CVE-2023-21529 to KEV list
Mon 13 Apr · 21:26 UTCCISACISA warns of active exploit in Microsoft Exchange CVE‑2023‑21529
Tue 7 Apr · 21:02 UTCDark ReadingStorm-1175 Deploys Medusa Ransomware at 'High Velocity'
Tue 7 Apr · 08:11 UTCThe Hacker NewsChina linked Medusa gang uses zero days to hit UK health, finance

Who reported 8 outlets, last 12 months

  • SecurityOnline5
  • The Hacker News3
  • Security Affairs3
  • SecurityWeek3
  • Dark Reading2
  • CISA2
  • Securelist1
  • Ars Technica1
See the full timeline
  1. Microsoft Patches Exchange Flaw That Could Expose Staff MailboxesSecurity Affairs
  2. Microsoft Patches Exchange Flaw That Exposes Colleagues’ MailboxesThe Hacker News
  3. Microsoft Reissues Exchange Updates With New CVE-2026-96940 FlawSecurityOnline
  4. NightEagle Hackers Target Russian Firms With GhostContainer BackdoorSecurityOnline
  5. Microsoft Fixes Nearly 1,000 Flaws in Record Patch Tuesday UpdateSecurity Affairs
  6. Microsoft Fixes 974 Flaws as Two Windows Zero Days Face ExploitationDark Reading
  7. Microsoft’s Record 972-Flaw Patch Haul Includes Two Zero-DaysArs Technica
  8. Microsoft Fixes 974 Flaws in Record Patch Tuesday UpdateSecurityWeek
  9. Microsoft to Block Outdated Exchange Servers from Cloud EmailSecurityOnline
  10. Microsoft Patches Nine Cloud Flaws as Exchange Attacks IntensifySecurityWeek

All CVEs in coverage

8
CVE-2020-0688Microsoft Exchange Server Validation Key Remote Code Execution VulnerabilityCVSS8.8HighExploited99.9%EPSS1article
CVE-2023-21529Microsoft Exchange Server Deserialization of Untrusted Data VulnerabilityCVSS8.8HighExploited59%EPSS7articles
CVE-2026-96940Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilityCVSS8.8High–Not in KEV2.8%EPSS3articles
CVE-2026-45504Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilityCVSS8.8High–Not in KEV1.2%EPSS1article
CVE-2026-55007Microsoft Exchange Server 2019 Cumulative Update 14 vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS3articles
CVE-2026-62911Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilityCVSS8.0High–Not in KEV0.7%EPSS3articles
CVE-2026-69380Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilityCVSS8.1High–Not in KEV0.7%EPSS2articles
CVE-2026-45501Microsoft Exchange Server 2016 Cumulative Update 23 vulnerabilityCVSS6.5Medium–Not in KEV0.5%EPSS1article
How these numbers are made

CISA KEV counts use the full catalogue, refreshed every 10 minutes. CVEs in coverage are those recorded by CyberSIXT. BOD 22-01 deadlines bind US federal civilian agencies.

CVEs with FIRST EPSS at or above the 95th percentile (top 5%), excluding CVEs in CISA KEV. EPSS estimates exploitation probability over the next 30 days.

Coverage is above its usual rate at three or more articles in 7 days and at least 2.5 times the weekly mean of the preceding 8 weeks.

Product names are grouped by normalised names, with version and edition tails removed.

Fix listed refers to an advisory. Unknown fix status is counted as not listed.

On this device

Following

Intel

VendorsThreat actorsResearch reports

Settings

CyberSIXT summarises security news every 30 minutes.
↑↓ move↵ open⌘C copy CVE IDEsc close

Keyboard shortcuts

Everything works with a mouse or touch. Shortcuts are a faster path.

Search ⌘K
Search /
Next item J
Previous item K
Go to Today GT
Go to News GN
Go to CVEs GC
Go to Briefing GB
Reduce motion on this device