Exchange Server
Vendor:
First CVE: Jan 1, 1998 · Active for 28 years
247
Total CVEs
More Total CVEs than 100% of tracked products
8.5
Avg CVEs / Year
Higher CVE frequency than 94% of tracked products
6.9
Avg CVSS
Higher Avg CVSS than 39% of tracked products
8.1%
KEV Rate
Higher KEV Rate than 97% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Exchange Server over time
Volume of CVEsAvg CVSS Base Score
First CVE
Jan 1, 1998
28 years ago
Most Recent CVE
Jun 9, 2026
45 days ago
CVE Severity & Scoring
Exchange Server247 CVEs
44%
45%
9%
All CVEs352,294 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local23 (9.3%)
Network115 (46.6%)
Unknown81 (32.8%)
Physical0 (0.0%)
Adjacent Network28 (11.3%)
Attack Complexity
Low155 (62.8%)
High11 (4.5%)
Unknown81 (32.8%)
User Interaction
None104 (42.1%)
Unknown81 (32.8%)
Required62 (25.1%)
Privileges Required
Low66 (26.7%)
High14 (5.7%)
None86 (34.8%)
Unknown81 (32.8%)
Top CVEs
Signals from CVEs in this product scope (247 CVEs).
247 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2021-26855CRITICAL Microsoft Exchange Server Remote Code Execution Vulnerability | Mar 3, 2021 | 9.8 | 99 | YES | YES |
CVE-2021-34523CRITICAL Microsoft Exchange Server Elevation of Privilege Vulnerability | Jul 14, 2021 | 9.8 | 98 | YES | YES |
CVE-2021-34473CRITICAL Microsoft Exchange Server Remote Code Execution Vulnerability | Jul 14, 2021 | 9.8 | 98 | YES | YES |
CVE-2021-27065HIGH Microsoft Exchange Server Remote Code Execution Vulnerability | Mar 3, 2021 | 7.8 | 98 | YES | YES |
CVE-2020-0688HIGH A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption | Feb 11, 2020 | 8.8 | 98 | YES | YES |
CVE-2022-41082HIGH Microsoft Exchange Server Remote Code Execution Vulnerability | Oct 3, 2022 | 8.0 | 97 | YES | YES |
CVE-2022-41040HIGH Microsoft Exchange Server Elevation of Privilege Vulnerability | Oct 3, 2022 | 8.8 | 97 | YES | YES |
CVE-2021-42321HIGH Microsoft Exchange Server Remote Code Execution Vulnerability | Nov 10, 2021 | 8.8 | 97 | YES | YES |
CVE-2021-33766HIGH Microsoft Exchange Server Information Disclosure Vulnerability | Jul 14, 2021 | 7.5 | 97 | YES | YES |
CVE-2021-31207MEDIUM Microsoft Exchange Server Security Feature Bypass Vulnerability | May 11, 2021 | 6.6 | 97 | YES | YES |
Exploit Exposure
Signals from CVEs in this product scope (247 CVEs).
CISA KEV
20 CVEs
8.1% of CVEs· 97th percentile
Metasploit
15 CVEs
6.1% of CVEs· 97th percentile
Nuclei
8 CVEs
3.2% of CVEs· 97th percentile
ExploitDB
20 CVEs
8.1% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (247 CVEs).
Media Mentions
Signals from CVEs in this product scope (247 CVEs).
Top CNAs Publishing CVEs For Exchange Server
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 5.5 | 20 | 5.8 | 26.3% | 0 | 2 |
| 5.0 | 8 | 6.5 | 25.3% | 0 | 1 |
| 4.0 | 2 | 6.3 | 13.1% | 0 | 1 |
| 2019 | 122 | 7.6 | 23.8% | 18 | 18 |
| 2016 | 154 | 7.4 | 20.3% | 19 | 23 |
| 2013 | 101 | 6.6 | 22.0% | 16 | 21 |
| 2010 | 27 | 7.3 | 17.3% | 5 | 2 |
| 2007 | 16 | 5.7 | 18.6% | 0 | 2 |
| 2003 | 19 | 6.7 | 31.0% | 0 | 6 |
| 2000 | 28 | 5.5 | 30.9% | 0 | 6 |