CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability Advisory (CVE-2023-21529)
[Affected Scope] Microsoft Exchange Server 2013, 2016, and 2019
[Impact] An authenticated attacker can execute arbitrary commands with SYSTEM privileges and fully compromise the server by sending specially crafted serialized data
[Mitigation] Immediately apply the latest Cumulative Updates (CU) and Security Updates (SU) provided by Microsoft
Microsoft Exchange Server Remote Code Execution Vulnerability (CVE-2021-42321) Analysis and Mitigation Guide
[Affected Scope] On-premises Microsoft Exchange Server 2016 and 2019
[Impact] Authenticated attackers can execute arbitrary code with SYSTEM privileges, leading to full server compromise
[Mitigation] Immediately apply the official Microsoft Cumulative Update (CU) and Security Update (KB5007409)
Microsoft Exchange Server Remote Code Execution (RCE) Vulnerability Analysis and Mitigation Guide (CVE-2020-17144)
[Affected Scope] Microsoft Exchange Server 2010 Service Pack 3, 2013, 2016, and 2019
[Impact] An authenticated attacker can send specially crafted payloads to execute arbitrary code with SYSTEM privileges, leading to full server compromise
[Mitigation] Immediately apply the official Microsoft security updates and restrict external access to Exchange management interfaces
Microsoft Exchange Server Elevation of Privilege and NTLM Relay Vulnerability (CVE-2018-8581) Analysis & Mitigation Guide
[Affected Scope] Microsoft Exchange Server 2010, 2013, 2016, and 2019
[Impact] An attacker can elevate privileges to SYSTEM/Exchange Windows Permissions, leading to a complete compromise of the Active Directory domain controller
[Mitigation] Remove the 'DisableLoopbackCheck' registry key, apply the latest Exchange Cumulative Updates, and enable Extended Protection for Authentication (EPA) on EWS