UpHeron
All vulnerabilities

Servers and applications

CVE-2018-16793

Rollup 18 for Microsoft Exchange Server 2010 SP3 and previous versions has an SSRF vulnerability via the username parameter in /owa/auth/logon.aspx in the OWA (Outlook Web Access) login page.

Severity
High 8.6
Published
21 Sept 2018
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
11% in the next 30 daysHigher than 96% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Microsoft Exchange ServerServers and applications · cpe:a:microsoft:exchange_server
  • Version 2010-sp3_rollup18
  • Version 2010-sp3_rollup17
  • Version 2010-sp3_rollup16
  • Version 2010-sp3_rollup15
All 18 release lines
  • Version 2010-sp3_rollup1
  • Version 2010-sp3_rollup2
  • Version 2010-sp3_rollup3
  • Version 2010-sp3_rollup4
  • Version 2010-sp3_rollup5
  • Version 2010-sp3_rollup6
  • Version 2010-sp3_rollup7
  • Version 2010-sp3_rollup8
  • Version 2010-sp3_rollup9
  • Version 2010-sp3_rollup10
  • Version 2010-sp3_rollup11
  • Version 2010-sp3_rollup12
  • Version 2010-sp3_rollup13
  • Version 2010-sp3_rollup14
  • Version 2010-sp3_rollup15
  • Version 2010-sp3_rollup16
  • Version 2010-sp3_rollup17
  • Version 2010-sp3_rollup18

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-16793
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-16793