CVE-2026-87692: Microsoft Exchange Server Elevation of Privilege Vulnerability
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Other sources
Microsoft Exchange Server Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.056Patch KB5128895 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2507.077Patch KB5128898 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.050Patch KB5128897
Event History
Frequently Asked Questions
Which Exchange Server deployments should be prioritized for review?
The affected software list includes Microsoft Exchange Server Subscription Edition RTM, Exchange Server 2016, and Exchange Server 2019.
What access does an attacker need to exploit this issue?
The attacker must already be authorized and have local access to the affected Exchange Server. The supplied vector indicates low privileges are required and no user interaction is needed.