Privilege Escalation Vulnerability in Microsoft Exchange Server by Microsoft
CVE-2026-118154

8.8HIGH

Key Information:

Vendor

Microsoft
Status
Microsoft Exchange Server Subscription Edition Rtm
Vendor
CVE Published:
10 November 2026

What is CVE-2026-118154?

A significant vulnerability exists in Microsoft Exchange Server due to its reliance on untrusted inputs for making security decisions. This flaw allows authorized attackers to elevate their privileges on the network, potentially leading to unauthorized actions and access to sensitive information. Implementing the recommended security patches is essential to mitigate this risk and enhance the overall security posture of affected environments.

Affected Version(s)

Microsoft Exchange Server Subscription Edition RTM x64-based Systems 15.02.0.0 < 15.02.2562.057

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE...
vendor-advisorypatch

CVSS V3.1

Score:
8.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.