NewsNCSC-NL
NCSC-2026-0477 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft Exchange server
Linked advisories
- CVE-2026-118157Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-118208Microsoft Exchange Server Spoofing Vulnerability
- CVE-2026-118149Microsoft Exchange Server Subscription Edition RTM: Code-Injection
- CVE-2026-118154Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-118150Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-118151Microsoft Exchange Server Subscription Edition RTM: externe Kontrolle von Dateinamen oder -pfaden
- CVE-2026-118157Microsoft Exchange Server Subscription Edition RTM: Rechteausweitung
- CVE-2026-118208Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.
- CVE-2026-118154Microsoft Exchange Server Subscription Edition RTM: Sicherheitsentscheidung auf Basis nicht vertrauenswürdiger Eingaben
- CVE-2026-118150Microsoft Exchange Server Subscription Edition RTM: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- CVE-2026-118152Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
- CVE-2026-118153Microsoft Exchange Server Denial of Service Vulnerability
- CVE-2026-118153Microsoft Exchange Server Subscription Edition RTM: ineffiziente algorithmische Komplexität
- CVE-2026-118150Microsoft Exchange Server Subscription Edition RTM: Umgehung der Autorisierung über nutzergesteuerten Schlüssel
- CVE-2026-118157Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-118149Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2026-118149Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
- CVE-2026-118154Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-118207Microsoft Exchange Server Subscription Edition RTM: falsch aufgelöster Name oder Verweis
- CVE-2026-118153Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
- CVE-2026-118152Microsoft Exchange Server Subscription Edition RTM: Cross-Site-Request-Forgery (CSRF)
- CVE-2026-118207Microsoft Exchange Server Remote Code Execution Vulnerability
- CVE-2026-118153Microsoft Exchange Server Subscription Edition RTM: ineffiziente algorithmische Komplexität
- CVE-2026-118152Microsoft Exchange Server Spoofing Vulnerability
- CVE-2026-118208Microsoft Exchange Server Subscription Edition RTM: Spoofing
- CVE-2026-118151Microsoft Exchange Server Elevation of Privilege Vulnerability
- CVE-2026-118149Microsoft Exchange Server Subscription Edition RTM: Mehrere Schwachstellen
- CVE-2026-118152Microsoft Exchange Server Subscription Edition RTM: Cross-Site-Request-Forgery (CSRF)
- CVE-2026-118207November 2026 Monthly Patch
- CVE-2026-118149Microsoft Exchange Server Subscription Edition RTM: Code-Injection
- CVE-2026-118151External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
- CVE-2026-118154Microsoft Exchange Server Subscription Edition RTM: Sicherheitsentscheidung auf Basis nicht vertrauenswürdiger Eingaben
- CVE-2026-118207Microsoft Exchange Server Subscription Edition RTM: falsch aufgelöster Name oder Verweis
- CVE-2026-118207Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
- CVE-2026-118157Microsoft Exchange Server Subscription Edition RTM: Rechteausweitung
- CVE-2026-118208Microsoft Exchange Server Subscription Edition RTM: Spoofing
- CVE-2026-118151Microsoft Exchange Server Subscription Edition RTM: externe Kontrolle von Dateinamen oder -pfaden
- CVE-2026-118150Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Affected vendors and products
Source: https://advisories.ncsc.nl/advisory?id=NCSC-2026-0477
ID