CVE-2026-87695: Microsoft Exchange Server Elevation of Privilege Vulnerability
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Other sources
Microsoft Exchange Server Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.050Patch KB5128897 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2507.077Patch KB5128898 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.056Patch KB5128895 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1748.055Patch KB5128896
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized on the affected Exchange Server and able to act locally. The provided severity vector indicates low attack complexity, low privileges required, and no user interaction.
Which Exchange Server releases are listed as affected?
Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, and Microsoft Exchange Server Subscription Edition RTM are listed.
What impact could successful exploitation have?
Successful exploitation can elevate the authorized local attacker's privileges. The supplied vector rates confidentiality, integrity, and availability impact as high.