Microsoft · Exchange Server
CVE-2018-8581
Microsoft Exchange Server Privilege Escalation Vulnerability
What it is
An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.
CISA: A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.
What to do
Apply updates per vendor instructions.
Deadline for US federal agencies: March 17, 2022
More exploited flaws from Microsoft
| Added | Vulnerability | Product | Severity | Attack chance |
|---|---|---|---|---|
| Apr 13, 2026 | Deserialization of Untrusted Data | Exchange Server | High 8.8 | 59% |
| Aug 21, 2024 | Information Disclosure | Exchange Server | High 7.2 | 54% |
| Feb 15, 2024 | Privilege Escalation | Exchange Server | Critical 9.8 | 13% |
| Jan 10, 2023 | Privilege Escalation | Exchange Server | High 8.8 | 77% |
| Sep 30, 2022 | Server-Side Request Forgery | Exchange Server | High 8.8 | >99.9% |
| Sep 30, 2022 | Remote Code Execution | Exchange Server | High 8.0 | >99.9% |
| Jan 18, 2022 | Information Disclosure | Exchange Server | High 7.3 | 98% |
| Nov 3, 2021 | Validation Key Remote Code Execution | Exchange Server | High 8.8 | >99.9% |
Sources: Known Exploited Vulnerabilities (CISA, public domain), CVE records (cve.org) and EPSS (FIRST). The chance of attacks is the EPSS estimate that someone will try to exploit the flaw in the next 30 days.