CVE-2026-118149: Microsoft Exchange Server Remote Code Execution Vulnerability

Q: Does exploitation require prior authentication or user interaction?

The attacker must have low-level privileges, indicating authorized access is required. No user interaction is required, and the attack can be performed over the network.

Q: Which Exchange deployment is identified as affected?

The affected software listed is Microsoft Exchange Server Subscription Edition RTM.

Q: What security impact is assessed if exploitation succeeds?

The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability. It could allow code execution in the affected Exchange environment.

Published Nov 10, 2026

Updated

Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

Other sources

Microsoft Exchange Server Remote Code Execution Vulnerability

— Microsoft

Affected Software

1 affected componentFixes available

Microsoft Exchange Server Subscription Edition RTM<15.02.2562.057

15.02.2562.057

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.057Patch KB5133453

Event History

Nov 10, 2026

CVE Published

via Microsoft·04:00 PM

Data Sourced

via Microsoft·04:00 PM

DescriptionSeverityWeaknessAffected Software

CVE Published

via MITRE·06:21 PM

Data Sourced

via MITRE·06:21 PM

DescriptionSeverity

Data Sourced

via NVD·07:19 PM

DescriptionSeverityWeakness

Frequently Asked Questions

Does exploitation require prior authentication or user interaction?

The attacker must have low-level privileges, indicating authorized access is required. No user interaction is required, and the attack can be performed over the network.

Which Exchange deployment is identified as affected?

The affected software listed is Microsoft Exchange Server Subscription Edition RTM.

What security impact is assessed if exploitation succeeds?

The vulnerability is rated high severity with high impacts to confidentiality, integrity, and availability. It could allow code execution in the affected Exchange environment.

CVE-2026-118149: Microsoft Exchange Server Remote Code Execution Vulnerability

Other sources

Affected Software

Remediation

Event History

Frequently Asked Questions

Does exploitation require prior authentication or user interaction?

Which Exchange deployment is identified as affected?

What security impact is assessed if exploitation succeeds?

Company

Resources

Contact

Frequently Asked Questions

Does exploitation require prior authentication or user interaction?

Which Exchange deployment is identified as affected?

What security impact is assessed if exploitation succeeds?