CVE-2022-21978

HighCVSS 8.2/10Last modified Jun 17, 2026

Description

Microsoft Exchange Server Elevation of Privilege Vulnerability

Metrics

CVSS 3.1 8.2/10CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

Affected software

VendorProductVersions
MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 22>= 15.0.0, < 15.01.2375.028
MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 11>= 15.02.0, < 15.02.0986.026
MicrosoftMicrosoft Exchange Server 2013 Cumulative Update 23>= 15.00.0, < 15.00.1497.36
MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 23>= 15.01.0, < 15.01.2507.009
MicrosoftMicrosoft Exchange Server 2019 Cumulative Update 12>= 15.02.0, < 15.02.1118.009

References

Timeline

Published
May 10, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-219794.8Microsoft Exchange Server Information Disclosure VulnerabilityCVE-2022-21984.3The WPQA Builder WordPress plugin before 5.7 which is a companion plugin to the Hilmer and Discy , does not check authorization before displCVE-2022-219808.0Microsoft Exchange Server Elevation of Privilege VulnerabilityCVE-2022-219817.8Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2022-219837.5Win32 Stream Enumeration Remote Code Execution VulnerabilityCVE-2022-219848.8Windows DNS Server Remote Code Execution VulnerabilityCVE-2022-219855.5Windows Remote Access Connection Manager Information Disclosure VulnerabilityCVE-2022-219867.5.NET Denial of Service VulnerabilityCVE-2022-219878.0Microsoft SharePoint Server Spoofing VulnerabilityCVE-2022-219887.8Microsoft Office Visio Remote Code Execution VulnerabilityCVE-2022-219897.8Windows Kernel Elevation of Privilege VulnerabilityCVE-2022-21996.1The main MiCODUS MV720 GPS tracker web server has a reflected cross-site scripting vulnerability that could allow an attacker to gain contro