7.4High KEV Used in ransomware

CVE-2018-8581Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Microsoft Exchange Server Published: 2018-11-14 04:00 (7 years ago)

Known exploited — Microsoft Exchange Server Privilege Escalation Vulnerability

CISA confirmed this vulnerability is used in real attacks on 03.03.2022. Remediation deadline for US federal agencies: 17.03.2022.

Required action: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2018-8581

Description

An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

Data: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Published as the sources state it, in English.

Affected products and versions

Vendor	Product	Versions
microsoft	exchange server	2010
Microsoft	Microsoft Exchange Server	2010, 2013, 2016, 2019

References and patches

1042141 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
105837 vdb-entryBroken LinkThird Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8581 PatchVendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8581 US Government Resource

CPE matches (NVD) (4)

cpe:2.3:a:microsoft:exchange_server:2010:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2013:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*

CVSS score

7.4High

Source: CISA-ADP · CVSS 3.1

Attack vector: Network
Attack complexity: High
Privileges required: None
User interaction: None
Scope: Unchanged
Confidentiality: High
Integrity: High
Availability: None

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N

All scores (4)

CISA-ADP	CVSS 3.1	7.4High
nvd	CVSS 3.1	7.4High
134c704f-9b21-4f2e-91b3-4a467353bcc0	CVSS 3.1	7.4High
nvd	CVSS 2.0	5.8Medium

EPSS (chance of exploitation in 30 days)

27.56%

higher than 98% of all CVEs

CISA assessment (SSVC)

Exploitation: active
Automatable: no
Technical impact: total

Timeline

ID reserved2018-03-14
Published2018-11-14 04:00
Reached IP-DB2026-10-24 23:33
Added to KEV2022-03-03
Last updated2026-06-17 05:05

Assigned by (CNA): microsoft
NVD status: Analyzed

View at source: CVE.org · NVD

Get told when these products get a new vulnerability

Turn on email alerts

Free · with an account · switch off any time

Recent CVEs in the same product — Microsoft Exchange Server

9.3Critical

CVE-2026-70279 20 days ago

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

1.3%EPSS

8.1High

CVE-2026-70571 20 days ago

Microsoft Exchange Server Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

1.4%EPSS

8.8High

CVE-2026-77910 20 days ago

Microsoft Exchange Server Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

7.8High

CVE-2026-87692 20 days ago

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server Subscription Edition RTM

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

2.3%EPSS

7.8High

CVE-2026-87695 20 days ago

Microsoft Exchange Server Elevation of Privilege Vulnerability

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

7.5High

CVE-2026-87696 20 days ago

Microsoft Exchange Server Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.