CVE-2026-69641: Microsoft Exchange Server Elevation of Privilege Vulnerability
Published Sep 8, 2026
·Updated
Microsoft Exchange Server Elevation of Privilege Vulnerability
Other sources
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
— Microsoft
Affected Software
8 affected componentsFixes available
Microsoft Exchange Server Subscription Edition RTM<15.02.2562.049
15.02.2562.049
Microsoft Exchange Server 2019=15
15.02.1748.051
Microsoft Exchange Server 2019=14
15.02.1544.046
Microsoft Exchange Server 2016=23
15.01.2507.073
Microsoft Exchange Server=2016-cumulative_update_23
Microsoft Exchange Server=2019-cumulative_update_14
Microsoft Exchange Server=2019-cumulative_update_15
Microsoft Exchange Server Subscription Edition<15.02.2562.049
Remediation
Event History
Sep 8, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·05:12 PM
Data Sourced
via MITRE·05:12 PM
DescriptionSeverity
Data Sourced
via NVD·06:19 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must already be authorized to access the affected Microsoft Exchange Server and be able to reach it over the network. The available data does not indicate that unauthenticated attackers can exploit it.
2
Which Exchange Server releases are identified as affected?
Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, and Microsoft Exchange Server Subscription Edition RTM are listed.
3
What level of impact could successful exploitation have?
Successful exploitation can allow an authorized attacker to elevate privileges. The supplied severity vector indicates high potential impact to confidentiality, integrity, and availability, with scope changed.