7.4 High Exploited · ransomware

CVE-2018-8581 Microsoft Exchange Server Privilege Escalation Vulnerability

Active exploitation observed

· CISA KEV catalogue

Required action Apply updates per vendor instructions.

Ransomware campaigns Known to be used

Description

An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka "Microsoft Exchange Server Elevation of Privilege Vulnerability." This affects Microsoft Exchange Server.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft Exchange Server	2019	No fix stated
Microsoft Exchange Server	2016	No fix stated
Microsoft Exchange Server	2013	No fix stated
Microsoft Exchange Server	2010	No fix stated

References

1042141 www.securitytracker.com
105837 www.securityfocus.com
portal.msrc.microsoft.com portal.msrc.microsoft.com

Timeline

Published November 14, 2018
Added to the KEV catalogue March 3, 2022
Last modified October 21, 2025

The 18 CVEs of Microsoft Exchange Server →

CVE-2019-1136 An elevation of privilege vulnerability exists in Microsoft Exchange Server, aka 'Microsoft Exchange Server Elevation of… Not rated CVE-2019-1084 An information disclosure vulnerability exists when Exchange allows creation of entities with Display Names having… Not rated CVE-2019-0858 A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle… Not rated CVE-2019-0817 A spoofing vulnerability exists in Microsoft Exchange Server when Outlook Web Access (OWA) fails to properly handle… Not rated

Track this CVE