Cross-Site Request Forgery Vulnerability in Microsoft Exchange Server
CVE-2026-118152

6.5MEDIUM

Key Information:

Vendor

Microsoft
Status
Microsoft Exchange Server Subscription Edition Rtm
Vendor
CVE Published:
10 November 2026

What is CVE-2026-118152?

A Cross-Site Request Forgery (CSRF) vulnerability in Microsoft Exchange Server enables unauthorized attackers to perform spoofing attacks, potentially compromising sensitive information and posing significant security risks within the network. Attackers can exploit this vulnerability to execute unintended actions on behalf of legitimate users, thereby undermining the integrity and security of the system.

Affected Version(s)

Microsoft Exchange Server Subscription Edition RTM x64-based Systems 15.02.0.0 < 15.02.2562.057

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
6.5
Severity:
MEDIUM
Confidentiality:
None
Integrity:
High
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.