CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability
Microsoft Exchange Server Remote Code Execution Vulnerability
Other sources
Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.050Patch KB5128897 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1748.055Patch KB5128896 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.056Patch KB5128895 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2507.077Patch KB5128898
Event History
Frequently Asked Questions
Does exploitation require an Exchange account or user interaction?
No. The vulnerability is described as exploitable by an unauthorized attacker over a network, with no privileges or user interaction required.
Which Exchange Server deployments should be prioritized for review?
Review Microsoft Exchange Server 2016, Exchange Server 2019, and Exchange Server Subscription Edition RTM deployments.