CVE-2026-55007: Microsoft Exchange Server Remote Code Execution Vulnerability
Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
Other sources
Microsoft Exchange Server Remote Code Execution Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.049Patch KB5121608 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.046Patch KB5121610 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1748.051Patch KB5121609
Event History
Frequently Asked Questions
Which Exchange Server deployments are identified as affected?
The affected software listed is Microsoft Exchange Server 2019 and Microsoft Exchange Server Subscription Edition RTM.
Does exploitation require authentication or user interaction?
The provided vector indicates no privileges are required and no user interaction is required. The vulnerability is remotely reachable over a network, although exploitation complexity is rated high.
What impact could successful exploitation have?
Successful exploitation can allow unauthorized remote code execution. The supplied metrics rate confidentiality, integrity, and availability impact as high.