The worst vulnerability, the RCE, was patched before Microsoft was even notified. The others are definitely bugs, but they do require valid credentials, which l

The worst vulnerability, the RCE, was patched before Microsoft was even notified. The others are definitely bugs, but they do require valid credentials, which limit explotiability and therefore risk. These aren't nearly as bad as many of the CVEs that other vendors patch every week. It's hard to say what kind of files an authenticated user can read on fhr exchange server without the details on the vulnerabilities.