CVE-2026-87695: Microsoft Exchange Server Elevation of Privilege Vulnerability
Published Oct 13, 2026
·Updated
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Other sources
Microsoft Exchange Server Elevation of Privilege Vulnerability
— Microsoft
Affected Software
8 affected componentsFixes available
Microsoft Exchange Server Subscription Edition RTM<15.02.2562.056
15.02.2562.056
Microsoft Exchange Server=2016-cumulative_update_23
Microsoft Exchange Server=2019-cumulative_update_14
Microsoft Exchange Server=2019-cumulative_update_15
Microsoft Exchange Server Subscription Edition<15.02.2562.056
Microsoft Exchange Server 2019>=15.02.1748<15.02.1748.055
15.02.1748.055
Microsoft Exchange Server 2016>=15.01.2507<15.01.2507.077
15.01.2507.077
Microsoft Exchange Server 2019>=15.02.1544<15.02.1544.050
15.02.1544.050
Remediation
Event History
Oct 13, 2026
CVE Published
via Microsoft·02:00 PM
Data Sourced
via Microsoft·02:00 PM
DescriptionSeverityWeaknessAffected Software
CVE Published
via MITRE·07:01 PM
Data Sourced
via MITRE·07:01 PM
DescriptionSeverity
Data Sourced
via NVD·07:21 PM
RemedyDescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
Who can exploit this vulnerability?
An attacker must already be authorized on the affected Exchange Server and able to act locally. The provided severity vector indicates low attack complexity, low privileges required, and no user interaction.
2
Which Exchange Server releases are listed as affected?
Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, and Microsoft Exchange Server Subscription Edition RTM are listed.
3
What impact could successful exploitation have?
Successful exploitation can elevate the authorized local attacker's privileges. The supplied vector rates confidentiality, integrity, and availability impact as high.