CVE-2026-69380: Microsoft Exchange Server Elevation of Privilege Vulnerability
Published Sep 8, 2026
·Updated
Microsoft Exchange Server Elevation of Privilege Vulnerability
Other sources
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
— NVD
Affected Software
9 affected componentsFixes available
Microsoft Exchange Server
Microsoft Exchange Server 2016=23
15.01.2507.073
Microsoft Exchange Server 2019=14
15.02.1544.046
Microsoft Exchange Server 2019=15
15.02.1748.051
Microsoft Exchange Server Subscription Edition RTM<15.02.2562.049
15.02.2562.049
Microsoft Exchange Server=2016-cumulative_update_23
Microsoft Exchange Server=2019-cumulative_update_14
Microsoft Exchange Server=2019-cumulative_update_15
Microsoft Exchange Server Subscription Edition<15.02.2562.049
Remediation
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·05:12 PM
Data Sourced
via MITRE·05:12 PM
DescriptionSeverity
Data Sourced
via NVD·06:18 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What access does an attacker need to exploit this issue?
The attacker needs low-level privileges and can exploit the issue over the network. No user interaction is required, and the attack complexity is rated low.
2
What could successful exploitation affect?
Successful exploitation can have high impact on confidentiality and integrity. The available data does not indicate an availability impact, and the vulnerability does not affect components beyond the vulnerable security authority.
3
Can this be exploited anonymously?
No. The attack vector indicates that an attacker must already hold low-level privileges before exploitation.