CVE-2026-69375: Microsoft Exchange Server Tampering Vulnerability
Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.
Other sources
Microsoft Exchange Server Tampering Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1748.051Patch KB5121609 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2507.073Patch KB5121611 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.046Patch KB5121610 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.049Patch KB5121608
Event History
Frequently Asked Questions
Which Exchange Server deployments are listed as affected?
Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, and Microsoft Exchange Server Subscription Edition RTM are listed.
Does exploitation require authentication or user interaction?
The attacker must be authorized and requires low privileges. The vector is network-based, exploitation complexity is low, and no user interaction is required.
What is the expected security impact?
The reported impact is high on integrity, meaning an attacker can perform tampering. No confidentiality or availability impact is indicated.