Microsoft Exchange Server known exploited vulnerabilities, ranked
CISA lists 17 Microsoft Exchange Server CVEs as exploited in the wild. 1 were added in the last 12 months and 13 are known to be used in ransomware. The table ranks all of them by EPSS, FIRST's estimate of the chance a CVE is exploited in the next 30 days, so the first rows are the ones to patch first.
Patch these first
- CVE-2021-34473: EPSS 100.00%, used in ransomware, added 2021-11-03
- CVE-2021-26855: EPSS 100.00%, used in ransomware, added 2021-11-03
- CVE-2021-34523: EPSS 99.99%, used in ransomware, added 2021-11-03
- CVE-2022-41082: EPSS 99.97%, used in ransomware, added 2022-09-30
- CVE-2020-0688: EPSS 99.96%, used in ransomware, added 2021-11-03
All 17 Microsoft Exchange Server CVEs in CISA KEV, by EPSS
| # | CVE | Flaw | EPSS | Ransomware | Added | Federal due |
|---|---|---|---|---|---|---|
| 1 | CVE-2021-34473 | Exchange Server Remote Code Execution | 100.00% | Yes | 2021-11-03 | 2021-11-17 |
| 2 | CVE-2021-26855 | Exchange Server Remote Code Execution | 100.00% | Yes | 2021-11-03 | 2022-05-03 |
| 3 | CVE-2021-34523 | Exchange Server Privilege Escalation | 99.99% | Yes | 2021-11-03 | 2021-11-17 |
| 4 | CVE-2022-41082 | Exchange Server Remote Code Execution | 99.97% | Yes | 2022-09-30 | 2022-10-21 |
| 5 | CVE-2020-0688 | Exchange Server Validation Key Remote Code Execution | 99.96% | Yes | 2021-11-03 | 2022-05-03 |
| 6 | CVE-2022-41040 | Exchange Server Server-Side Request Forgery | 99.96% | Yes | 2022-09-30 | 2022-10-21 |
| 7 | CVE-2021-27065 | Exchange Server Remote Code Execution | 99.88% | Yes | 2021-11-03 | 2022-05-03 |
| 8 | CVE-2021-31207 | Exchange Server Security Feature Bypass | 99.78% | Yes | 2021-11-03 | 2021-11-17 |
| 9 | CVE-2021-33766 | Exchange Server Information Disclosure | 98.1% | – | 2022-01-18 | 2022-02-01 |
| 10 | CVE-2021-26857 | Exchange Server Remote Code Execution | 95.8% | Yes | 2021-11-03 | 2022-05-03 |
| 11 | CVE-2021-26858 | Exchange Server Remote Code Execution | 93.7% | Yes | 2021-11-03 | 2022-05-03 |
| 12 | CVE-2022-41080 | Exchange Server Privilege Escalation | 77.3% | Yes | 2023-01-10 | 2023-01-31 |
| 13 | CVE-2023-21529 | Exchange Server Deserialization of Untrusted Data | 59.3% | Yes | 2026-04-13 | 2026-04-27 |
| 14 | CVE-2021-31196 | Exchange Server Information Disclosure | 54.1% | – | 2024-08-21 | 2024-09-11 |
| 15 | CVE-2020-17144 | Exchange Server Remote Code Execution | 36.5% | – | 2021-11-03 | 2022-05-03 |
| 16 | CVE-2018-8581 | Exchange Server Privilege Escalation | 27.4% | Yes | 2022-03-03 | 2022-03-17 |
| 17 | CVE-2024-21410 | Exchange Server Privilege Escalation | 12.6% | – | 2024-02-15 | 2024-03-07 |
EPSS changes daily; a CVE with a low EPSS that is in KEV is still exploited somewhere. Federal due dates bind US federal civilian agencies; everyone else can use them as a priority hint.
Sources: CISA KEV, FIRST EPSS.
More: all Microsoft KEV CVEs · other Microsoft products: SharePoint · Windows · SharePoint Server · Defender · Internet Explorer · Office · Win32k · free KEV badge for Microsoft · all vendors