7.5
High
CVE-2025-64666 Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a…
Description
Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft Exchange Server 2019 Cumulative Update 15 15.02 | 15.02.0.0 → < 15.02.1748.042 | 15.02.1748.042 |
| Microsoft Exchange Server 2016 Cumulative Update 23 15.01 | 15.01.0.0 → < 15.01.2507.063 | 15.01.2507.063 |
| Microsoft Exchange Server Subscription Edition RTM 15.02 | 15.02.0.0 → < 15.02.2562.035 | 15.02.2562.035 |
| Microsoft Exchange Server 2019 Cumulative Update 14 15.02 | 15.02.0.0 → < 15.02.1544.037 | 15.02.1544.037 |
Other CVEs of Microsoft Exchange Server 2019 Cumulative Update 15
The 45 CVEs of Microsoft Exchange Server 2019 Cumulative Update 15 →
CVE-2026-70279
Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows…
9.3
Critical
CVE-2026-87696
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate…
7.5
High
CVE-2026-87695
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to…
7.8
High
CVE-2026-70571
Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network
8.1
High