CVE-2026-87692: Microsoft Exchange Server Elevation of Privilege Vulnerability
Published Oct 13, 2026
·Updated
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Other sources
Microsoft Exchange Server Elevation of Privilege Vulnerability
— Microsoft
Affected Software
6 affected componentsFixes available
Microsoft Exchange Server Subscription Edition RTM<15.02.2562.056
15.02.2562.056
Microsoft Exchange Server=2016-cumulative_update_23
Microsoft Exchange Server=2019-cumulative_update_14
Microsoft Exchange Server Subscription Edition<15.02.2562.056
Microsoft Exchange Server 2019>=15.02.1544<15.02.1544.050
15.02.1544.050
Microsoft Exchange Server 2016>=15.01.2507<15.01.2507.077
15.01.2507.077
Remediation
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·07:01 PM
Data Sourced
via MITRE·07:01 PM
DescriptionSeverity
Data Sourced
via NVD·07:21 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Which Exchange Server deployments should be prioritized for review?
The affected software list includes Microsoft Exchange Server Subscription Edition RTM, Exchange Server 2016, and Exchange Server 2019.
2
What access does an attacker need to exploit this issue?
The attacker must already be authorized and have local access to the affected Exchange Server. The supplied vector indicates low privileges are required and no user interaction is needed.