CVE-2025-64666High· 7.5▾ TwilightImproper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0.2 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Oct 14.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
Last analysed / modified upstream
1.0%
Improper input validation in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
exchange_server = 2016exchange_server = 2019exchange_server_subscription_edition < 15.02.2562.035Upgrade past the affected range:
exchange_server_subscription_edition 15.02.2562.035Connected by shared product, vendor, weakness, or advisory.
CVE-2026-108427High· 8.8Microsoft Office Word Remote Code Execution Vulnerability
CVE-2016-0025High· 7.3Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Office 2016, Word 2016, Word for Mac 2011, Word 2016 for Mac, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2010 SP2…
CVE-2025-64667Medium· 5.3User interface (ui) misrepresentation of critical information in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.
CVE-2026-97805Critical· 9.8Out-of-bounds read in Windows Partition Management Driver allows an unauthorized attacker to execute code over a network.
CVE-2015-2466Critical· 9.3Microsoft Office 2007 SP3, 2010 SP2, 2013 SP1, and 2013 RT SP1 allows remote attackers to execute arbitrary code via a crafted template, aka "Microsoft Office Remote Code Execution Vulnerability."
CVE-2026-96940High· 8.8Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.