CVE records

Every CVE as the CVE Program publishes it, refreshed every ten minutes, with NVD's analysis, CISA's known-exploited status and a healthcare tag. Subscribers get the CVEs that match their own systems on My program, by email as they are published. Where the data comes from: sources.

Updated under an hour ago (Oct 28, 2026, 5:40 PM ET)

What this means for you

This week: 3,216 CVEs published, 237 critical, and 5 newly confirmed exploited. Add your stack to see whether any of them hit you.

Do this next

Start free and add your stack

Free account, 1 product

This week's critical CVEs

Exploited in the last 30 days

Published in the last 7 days: 3,216; Show in the list
Critical, last 7 days: 237; Show in the list
Healthcare-tagged, last 7 days: 9; Show in the list
Known exploited (CISA KEV): 1,762; Show in the list

Showing CVEs that name the product microsoft:exchange_server. Show all products

56 CVEs

Showing 1 to 10.

CVE	Severity	Title	Published
CVE-2017-8540 Known exploited	High 7.8	The Microsoft Malware Protection Engine running on Microsoft Forefront and Microsoft Defender on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and… Assigned by microsoft	May 26, 2017
CVE-2018-8581 Known exploited	High 7.4	An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server. Assigned by microsoft	Nov 13, 2018
CVE-2020-0688 Known exploited	High 8.8	A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka 'Microsoft Exchange Memory Corruption Vulnerability'. Assigned by microsoft	Feb 11, 2020
CVE-2020-17144 Known exploited	High 8.4	Microsoft Exchange Remote Code Execution Vulnerability Assigned by microsoft	Dec 9, 2020
CVE-2021-26857 Known exploited	High 7.8	Microsoft Exchange Server Remote Code Execution Vulnerability Assigned by microsoft	Mar 2, 2021
CVE-2021-26855 Known exploited	Critical 9.1	Microsoft Exchange Server Remote Code Execution Vulnerability Assigned by microsoft	Mar 2, 2021
CVE-2021-26858 Known exploited	High 7.8	Microsoft Exchange Server Remote Code Execution Vulnerability Assigned by microsoft	Mar 2, 2021
CVE-2021-27065 Known exploited	High 7.8	Microsoft Exchange Server Remote Code Execution Vulnerability Assigned by microsoft	Mar 2, 2021
CVE-2021-31207 Known exploited	Medium 6.6	Microsoft Exchange Server Security Feature Bypass Vulnerability Assigned by microsoft	May 11, 2021
CVE-2021-31196 Known exploited	High 7.2	Microsoft Exchange Server Remote Code Execution Vulnerability Assigned by microsoft	Jul 14, 2021

CVSS is the assigning CNA's score where it gives one, otherwise NVD's. The healthcare tag is a documented heuristic (a list of clinical and health IT vendors, and clinical terms in the description), not a classification. The CVE record is authoritative.