CVE-2026-87696: Microsoft Exchange Server Elevation of Privilege Vulnerability
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Other sources
Microsoft Exchange Server Elevation of Privilege Vulnerability
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2507.077Patch KB5128898 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.050Patch KB5128897 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.056Patch KB5128895 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1748.055Patch KB5128896
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must already be authorized to access the affected Exchange Server and be able to reach it over the network. The available data does not indicate that unauthenticated attackers can exploit it.
Is user interaction required for exploitation?
No. The vulnerability metrics indicate that no user interaction is required once the attacker has the necessary authorized access and network reachability.
Which Exchange Server releases are identified as affected?
The listed affected products are Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, and Microsoft Exchange Server Subscription Edition RTM.
What impact could successful exploitation have?
Successful exploitation allows elevation of privilege. The provided severity metrics rate confidentiality, integrity, and availability impact as high.