CVE-2026-77910: Microsoft Exchange Server Elevation of Privilege Vulnerability
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Other sources
Microsoft Exchange Server Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1748.055Patch KB5128896 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2507.077Patch KB5128898 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.056Patch KB5128895 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.050Patch KB5128897
Event History
Frequently Asked Questions
Which Exchange Server deployments are listed as affected?
The affected software list includes Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, and Microsoft Exchange Server Subscription Edition RTM.
What access does an attacker need to exploit this issue?
The attacker must already be authorized and able to reach the affected Exchange Server over the network. No user interaction is required.