Cybersecurity articles tagged #Microsoft Exchange Server on RuntimeRebel.https://runtimerebel.comhttps://runtimerebel.com/blog/cve-2026-96940-exchange-server-auth-flaw-exposes-mailboxeshttps://runtimerebel.com/blog/cve-2026-96940-exchange-server-auth-flaw-exposes-mailboxesMicrosoft addresses a high-severity flaw, CVE-2026-96940, in on-premises Exchange Server allowing authenticated attackers to read mailboxes.Tue, 06 Oct 2026 03:50:32 GMTCVE-2026-96940Microsoft Exchange ServerPrivilege EscalationAuthorization Bypasshttps://runtimerebel.com/blog/cve-2026-62911-exchange-servers-vulnerable-to-mailbox-hijackhttps://runtimerebel.com/blog/cve-2026-62911-exchange-servers-vulnerable-to-mailbox-hijackNearly 22,000 Microsoft Exchange Servers remain unpatched against CVE-2026-62911, an auth bypass allowing mailbox hijack attacks.Tue, 01 Sep 2026 12:55:00 GMTMicrosoft Exchange ServerAuthentication BypassShadowserverCVE-2026-62911Mailbox Hijackhttps://runtimerebel.com/blog/owa-light-retirement-in-exchange-server-planning-for-the-changehttps://runtimerebel.com/blog/owa-light-retirement-in-exchange-server-planning-for-the-changeMicrosoft is retiring OWA Light in Exchange Server. This advisory details the operational impact, affected versions, and critical steps for administrators to manage user…Thu, 09 Jul 2026 11:02:25 GMTMicrosoft Exchange ServerOWA LightDeprecationEmail ClientOperational Securityhttps://runtimerebel.com/blog/cve-2026-42897-microsoft-exchange-xss-under-active-exploitationhttps://runtimerebel.com/blog/cve-2026-42897-microsoft-exchange-xss-under-active-exploitationCISA adds CVE-2026-42897, a Microsoft Exchange Server Cross-Site Scripting vulnerability, to KEV Catalog due to active exploitation. Immediate patching advised.Fri, 15 May 2026 20:32:11 GMTCVE-2026-42897Microsoft Exchange ServerCross Site ScriptingXSSCISA KEVActive Exploitationhttps://runtimerebel.com/blog/cve-2026-42897-microsoft-exchange-server-zero-day-exploited-in-wildhttps://runtimerebel.com/blog/cve-2026-42897-microsoft-exchange-server-zero-day-exploited-in-wildMicrosoft warns of CVE-2026-42897, a critical Exchange Server zero-day exploited in the wild. Implement Extended Protection mitigations immediately to secure systems.Fri, 15 May 2026 12:47:29 GMTCVE-2026-42897Microsoft Exchange ServerZero-DayNTLM Relayhttps://runtimerebel.com/blog/cve-2026-42897-how-attackers-exploit-microsoft-exchange-serverhttps://runtimerebel.com/blog/cve-2026-42897-how-attackers-exploit-microsoft-exchange-serverMicrosoft warns of active exploitation of CVE-2026-42897, a critical spoofing and XSS vulnerability in on-premise Exchange Server triggered via email.Fri, 15 May 2026 09:11:29 GMTCVE-2026-42897Microsoft Exchange ServerXSSSpoofingZero-Dayhttps://runtimerebel.com/blog/critical-rce-threats-confluence-ognl-exchange-server-patchinghttps://runtimerebel.com/blog/critical-rce-threats-confluence-ognl-exchange-server-patchingRuntime Rebel analyzes critical RCE vulnerabilities affecting Atlassian Confluence and Microsoft Exchange Server, alongside a high-severity SQLi in WP Reset.Thu, 23 Apr 2026 05:06:17 GMTAtlassian ConfluenceOGNL InjectionRCEMicrosoft Exchange ServerPatch TuesdayWordPressWP ResetSQL InjectionVulnerabilityhttps://runtimerebel.com/blog/cisa-kev-update-exchange-server-adobe-ms-windows-exploitshttps://runtimerebel.com/blog/cisa-kev-update-exchange-server-adobe-ms-windows-exploitsCISA adds seven vulnerabilities, including critical Microsoft Exchange Server deserialization, to its Known Exploited Vulnerabilities Catalog, urging immediate…Tue, 14 Apr 2026 00:47:03 GMTCVE-2012-1854CVE-2020-9715CVE-2023-21529CVE-2023-36424CVE-2025-60710CVE-2026-21643CVE-2026-34621Microsoft Exchange ServerAdobe AcrobatMicrosoft WindowsFortinetCISAKEV CatalogDeserializationUse After FreeSQL Injection