7.3Yüksek

CVE-2026-62914Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Serv… Yayım: 2026-08-11 20:04 (2 ay önce)

Açıklama

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

Zayıflık türü (CWE): CWE-79

Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.

Etkilenen ürünler ve sürümler

Üretici	Ürün	Sürümler
microsoft	exchange server	2016
microsoft	exchange server 2016	15.01.0.0 – < 15.01.2507.072
microsoft	exchange server 2019	15.02.0.0 – < 15.02.1748.049
microsoft	exchange server se	15.02.0.0 – < 15.02.2562.046
microsoft	exchange server subscription edition	< 15.02.2562.046
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	15.01.0.0 – < 15.01.2507.072
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 14	15.02.0.0 – < 15.02.1544.044
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 15	15.02.0.0 – < 15.02.1748.049
Microsoft	Microsoft Exchange Server Subscription Edition RTM	15.02.0.0 – < 15.02.2562.046

Kaynaklar ve yamalar

Microsoft Exchange Server Spoofing Vulnerability vendor-advisorypatchPatchVendor Advisory

CPE eşleşmeleri (NVD) (38)

cpe:2.3:a:microsoft:exchange_server:2016:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_1:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_10:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_11:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_12:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_13:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_14:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_15:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_16:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_17:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_18:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_19:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_2:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_20:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_21:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_22:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_3:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_4:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_5:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_6:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_7:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_8:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_9:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:-:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_1:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_10:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_11:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_12:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_13:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_2:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_3:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_4:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_5:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_6:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_7:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_8:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_9:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:* < 15.02.2562.046

CVSS puanı

7.3Yüksek

Kaynak: microsoft · CVSS 3.1

Saldırı yolu: Ağ
Karmaşıklık: Düşük
Gereken yetki: Düşük
Kullanıcı etkileşimi: Gerekir
Kapsam: Değişmez
Gizlilik: Yüksek
Bütünlük: Yüksek
Erişilebilirlik: Yok

CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C

Tüm puanlar (3)

cna	CVSS 3.1	7.3Yüksek
secure@microsoft.com	CVSS 3.1	7.3Yüksek
nvd	CVSS 3.1	5.4Orta

EPSS (30 günde istismar olasılığı)

0.45%

tüm CVE'lerin %39'inden yüksek

CISA değerlendirmesi (SSVC)

İstismar: none
Otomatikleştirilebilir: no
Teknik etki: total

Zaman çizelgesi

Numara ayrıldı2026-07-14
Yayımlandı2026-08-11 20:04
IP-DB'ye ulaştı2026-10-24 23:44
Son güncelleme2026-10-30 20:20

Numarayı veren (CNA): microsoft
NVD durumu: Analyzed

Kaynakta görüntüle: CVE.org · NVD

Bu ürünlerde yeni bir açık çıktığında haber alın

E-posta uyarılarını aç

Ücretsiz · üyelikle · istediğiniz an kapatılır

Aynı üründe son açıklar — Microsoft Exchange Server

9.3Kritik

CVE-2026-70279 21 gün önce

Microsoft Exchange Server Spoofing Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server 2019 Cumulative Update 15; Microsoft Microsoft Exchange Server Subscription Edition RTM

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

1.3%EPSS

8.1Yüksek

CVE-2026-70571 21 gün önce

Microsoft Exchange Server Remote Code Execution Vulnerability

Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

1.4%EPSS

8.8Yüksek

CVE-2026-77910 21 gün önce

Microsoft Exchange Server Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

7.8Yüksek

CVE-2026-87692 21 gün önce

Microsoft Exchange Server Elevation of Privilege Vulnerability

Microsoft Microsoft Exchange Server 2016 Cumulative Update 23; Microsoft Microsoft Exchange Server 2019 Cumulative Update 14; Microsoft Microsoft Exchange Server Subscription Edition RTM

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

2.3%EPSS

7.8Yüksek

CVE-2026-87695 21 gün önce

Microsoft Exchange Server Elevation of Privilege Vulnerability

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

7.5Yüksek

CVE-2026-87696 21 gün önce

Microsoft Exchange Server Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.