Security feed

24 October 2026

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. This vulnerability is part of the ProxyLogon exploit chain. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2021-26857

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-26857

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-26857
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3664 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:39:23 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

Exchange Server CVE-2021-27065

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-27065

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-27065
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3656 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:33 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

Exchange Server CVE-2021-26858

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-26858

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-26858
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3655 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:32 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

Exchange Server CVE-2021-26855

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-26855

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-26855
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3654 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:32 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Security Feature Bypass Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for security feature bypass. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2021-31207

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-31207

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-31207
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3625 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:14 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for remote code execution. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2021-34473

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-34473

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-34473
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3623 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:13 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Validation Key Remote Code Execution Vulnerability

Microsoft Exchange Server Validation Key fails to properly create unique keys at install time, allowing for remote code execution. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2020-0688

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2020-0688

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2020-0688
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3617 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:09 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2021-34523

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-34523

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-34523
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3613 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:07 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server improperly validates cmdlet arguments which allow an attacker to perform remote code execution. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2020-17144

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2020-17144

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2020-17144
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #3609 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:38:05 GMT
Publisher date: Wed, 03 Nov 2021 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Information Disclosure

Microsoft Exchange Server contains an information disclosure vulnerability which can allow an unauthenticated attacker to steal email traffic from target. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2021-33766

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-33766

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-33766
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2922 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:26:28 GMT
Publisher date: Tue, 18 Jan 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Privilege Escalation Vulnerability

A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2018-8581

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2018-8581

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2018-8581
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #2789 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:24:13 GMT
Publisher date: Thu, 03 Mar 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Server-Side Request Forgery Vulnerability

Microsoft Exchange Server allows for server-side request forgery. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41082 which allows for remote code execution. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2022-41040

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2022-41040

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2022-41040
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1423 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:02:21 GMT
Publisher date: Fri, 30 Sep 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Remote Code Execution Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for authenticated remote code execution. Dubbed "ProxyNotShell," this vulnerability is chainable with CVE-2022-41040 which allows for the remote code execution. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2022-41082

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2022-41082

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2022-41082
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1422 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:02:20 GMT
Publisher date: Fri, 30 Sep 2022 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. This vulnerability is chainable with CVE-2022-41082, which allows for remote code execution. CISA required action: Apply updates per vendor instructions.

Exchange Server CVE-2022-41080

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2022-41080

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2022-41080
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1387 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 21:01:57 GMT
Publisher date: Tue, 10 Jan 2023 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Exchange Server contains an unspecified vulnerability that allows for privilege escalation. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Exchange Server CVE-2024-21410

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2024-21410

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2024-21410
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1177 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:57:20 GMT
Publisher date: Thu, 15 Feb 2024 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Information Disclosure Vulnerability

Microsoft Exchange Server contains an information disclosure vulnerability that allows for remote code execution. CISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Exchange Server CVE-2021-31196

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2021-31196

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2021-31196
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #1102 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:56:34 GMT
Publisher date: Wed, 21 Aug 2024 00:00:00 GMT

Read the original announcement

advisoryCISA Known Exploited Vulnerabilities24 Oct 2026

Microsoft Exchange Server Deserialization of Untrusted Data Vulnerability

Microsoft Exchange Server contains a deserialization of untrusted data that allows an authenticated attacker to achieve remote code execution. CISA required action: Apply mitigations per vendor instructions, follow applicable BOD 22-01 guidance for cloud services, or discontinue use of the product if mitigations are unavailable.

Exchange Server CVE-2023-21529

Structured advisory · Revision 1Original source

Evidence and details

Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.

Security context

Source reference: kev:CVE-2023-21529

Exchange Server

Source reference: /product

Affected versions: Not stated in this record
Fixed versions: Not stated in this record
Prerequisites: Not stated in this record

Related CVEs: CVE-2023-21529
Source reference: /cveID

Publisher severity

No explicit severity was provided.

Event: #194 · Revision 1
Added to Heist Feed: Sat, 24 Oct 2026 20:42:10 GMT
Publisher date: Mon, 13 Apr 2026 00:00:00 GMT

Read the original announcement