Attack list
Microsoft Exchange
19 attacked bugs
Attackers used Microsoft Exchange bugs this year.
What to do
Ask whoever runs it (your web host or IT team) to install the vendor's latest security update now.
Attackers keep using these against anything that hasn't updated. Updating closes them.
BugConfirmed in attacks
- Microsoft bug: exchange server cross-site scriptingCVE-2026-42897May 15, 2026
- Microsoft Exchange Server bug: deserialization of untrusted dataCVE-2023-21529Apr 13, 2026
- Microsoft Exchange Server bug: information disclosureCVE-2021-31196Aug 21, 2024
- Microsoft Exchange Server bug: privilege escalationCVE-2024-21410Feb 15, 2024
- Microsoft Exchange Server bug: privilege escalationCVE-2022-41080Jan 10, 2023
- Microsoft Exchange Server bug: remote code executionCVE-2022-41082Sep 30, 2022
- Microsoft Exchange Server bug: -side request forgeryCVE-2022-41040Sep 30, 2022
- Microsoft Exchange Server bug: privilege escalationCVE-2018-8581Mar 3, 2022
- Microsoft Exchange Server bug: information disclosureCVE-2021-33766Jan 18, 2022
- Microsoft Exchange bug: server remote code executionCVE-2021-42321Nov 17, 2021
- Microsoft Exchange Server bug: remote code executionCVE-2020-17144Nov 3, 2021
- Microsoft Exchange Server bug: privilege escalationCVE-2021-34523Nov 3, 2021
- Microsoft Exchange Server bug: validation key remote code executionCVE-2020-0688Nov 3, 2021
- Microsoft Exchange Server bug: remote code executionCVE-2021-34473Nov 3, 2021
- Microsoft Exchange Server bug: security feature bypassCVE-2021-31207Nov 3, 2021
- Microsoft Exchange Server bug: remote code executionCVE-2021-26855Nov 3, 2021
- Microsoft Exchange Server bug: remote code executionCVE-2021-26858Nov 3, 2021
- Microsoft Exchange Server bug: remote code executionCVE-2021-27065Nov 3, 2021
- Microsoft Exchange Server bug: remote code executionCVE-2021-26857Nov 3, 2021
From the US government's list of bugs confirmed in real attacks (CISA KEV). Check everything you use.