Unscored

CVE-2017-11932

Microsoft Corporation Microsoft Exchange Server Published: 2017-12-13 00:00 (8 years ago)

Description

Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5 allow a spoofing vulnerability due to the way Outlook Web Access (OWA) validates web requests, aka "Microsoft Exchange Spoofing Vulnerability".

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
Microsoft Corporation	Microsoft Exchange Server	Microsoft Exchange Server 2016 CU5 and Microsoft Exchange Server 2016 CU5

References and patches

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11932
1039996 vdb-entry
102060 vdb-entry

CVSS score

Not scored yet. It appears here once the CNA, CISA or NVD scores it.

EPSS (chance of exploitation in 30 days)

5.88%

higher than 93% of all CVEs

Timeline

ID reserved2017-07-31
Published2017-12-13 00:00
Reached IP-DB2026-10-24 23:50
Last updated2024-09-17 07:29

Assigned by (CNA): microsoft

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Microsoft Exchange Server

9.3Critical

CVE-2026-70279 27 days ago

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

1.3%EPSS

8.1High

CVE-2026-70571 27 days ago

Microsoft Exchange Server Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

1.4%EPSS

8.8High

CVE-2026-77910 27 days ago

Microsoft Exchange Server Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

7.8High

CVE-2026-87692 27 days ago

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server Subscription Edition RTM

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

2.3%EPSS

7.8High

CVE-2026-87695 27 days ago

Microsoft Exchange Server Elevation of Privilege Vulnerability

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

7.5High

CVE-2026-87696 27 days ago

Microsoft Exchange Server Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.