Product of Microsoft

Exchange Server

As of 6 October 2026, 17 Microsoft Exchange Server vulnerabilities are on CISA's list of exploited vulnerabilities, 13 of them used in ransomware campaigns; 1 was added in 2026. Patch first: CVE-2023-21529.

Patch first

Patch first
#	Vulnerability	Product	Our group	Listed	Deadline	EPSS
1	CVE-2023-21529Deserialization of Untrusted Data	Microsoft Exchange Server	Patch nowRansomware use, listed within a year	2026-04-13	2026-04-27	0.59	2026-04-13 · due 2026-04-27
2	CVE-2020-0688Validation Key Remote Code Execution	Microsoft Exchange Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99; verified Exploit-DB entry	2021-11-03	2022-05-03	0.99	2021-11-03 · due 2022-05-03
3	CVE-2022-41040Server-Side Request Forgery	Microsoft Exchange Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2022-09-30	2022-10-21	0.99	2022-09-30 · due 2022-10-21
4	CVE-2022-41082Remote Code Execution	Microsoft Exchange Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2022-09-30	2022-10-21	0.99	2022-09-30 · due 2022-10-21
5	CVE-2021-26855Remote Code Execution	Microsoft Exchange Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2021-11-03	2022-05-03	0.99	2021-11-03 · due 2022-05-03
6	CVE-2021-27065Remote Code Execution	Microsoft Exchange Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2021-11-03	2022-05-03	0.99	2021-11-03 · due 2022-05-03
7	CVE-2021-31207Security Feature Bypass	Microsoft Exchange Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2021-11-03	2021-11-17	0.99	2021-11-03 · due 2021-11-17
8	CVE-2021-34473Remote Code Execution	Microsoft Exchange Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2021-11-03	2021-11-17	0.99	2021-11-03 · due 2021-11-17
9	CVE-2021-34523Privilege Escalation	Microsoft Exchange Server	Patch this weekRansomware use; Metasploit module; EPSS 0.99	2021-11-03	2021-11-17	0.99	2021-11-03 · due 2021-11-17
10	CVE-2022-41080Privilege Escalation	Microsoft Exchange Server	Patch this weekRansomware use; EPSS 0.77	2023-01-10	2023-01-31	0.77	2023-01-10 · due 2023-01-31
11	CVE-2021-33766Information Disclosure	Microsoft Exchange Server	Patch this weekEPSS 0.98	2022-01-18	2022-02-01	0.98	2022-01-18 · due 2022-02-01
12	CVE-2021-26857Remote Code Execution	Microsoft Exchange Server	Patch this weekRansomware use; EPSS 0.96	2021-11-03	2022-05-03	0.96	2021-11-03 · due 2022-05-03
13	CVE-2021-26858Remote Code Execution	Microsoft Exchange Server	Patch this weekRansomware use; EPSS 0.94	2021-11-03	2022-05-03	0.94	2021-11-03 · due 2022-05-03
14	CVE-2021-31196Information Disclosure	Microsoft Exchange Server	Patch this weekEPSS 0.54	2024-08-21	2024-09-11	0.54	2024-08-21 · due 2024-09-11
15	CVE-2018-8581Privilege Escalation	Microsoft Exchange Server	Patch this weekRansomware use	2022-03-03	2022-03-17	0.27	2022-03-03 · due 2022-03-17
16	CVE-2020-17144Remote Code Execution	Microsoft Exchange Server	Patch soon	2021-11-03	2022-05-03	0.37	2021-11-03 · due 2022-05-03
17	CVE-2024-21410Privilege Escalation	Microsoft Exchange Server	Patch soon	2024-02-15	2024-03-07	0.13	2024-02-15 · due 2024-03-07

Added each year

Entries CISA added each year, removed ones included. Source: CISA KEV.

Show the numbers

Period	entries added
2021	9
2022	4
2023	1
2024	2
2025	none
2026	1

Used in ransomware

Changes CISA made to these entries

2026-04-21
CVE-2023-21529 Microsoft Exchange ServerRansomware use: Unknown to Known.
2025-12-17
CVE-2021-27065 Microsoft Exchange ServerDeadline moved from 16 April 2021 to 3 May 2022.
2025-12-17
CVE-2021-26858 Microsoft Exchange ServerDeadline moved from 16 April 2021 to 3 May 2022.
2025-12-17
CVE-2021-26857 Microsoft Exchange ServerDeadline moved from 16 April 2021 to 3 May 2022.
2025-12-17
CVE-2021-26855 Microsoft Exchange ServerDeadline moved from 16 April 2021 to 3 May 2022.

Every change we recorded