Published advisory · CVE-2026-118150
CVE-2026-118150 - Microsoft Exchange Server Elevation of Privilege Vulnerability
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H Vulnerability analysis
An authenticated attacker can bypass authorization in Microsoft Exchange Server using a user-controlled key, gaining elevated privileges over the network. Microsoft classifies the weakness as CWE-639. The CVSS assessment requires low privileges and no user interaction.
Affected Versions
Microsoft identifies Exchange Server Subscription Edition RTM on x64 systems as affected, from build 15.02.0.0 up to, but excluding, 15.02.2562.057.
Solution / Mitigation
Install the Exchange Server security update KB5133453, which provides fixed build 15.02.2562.057, or a superseding security update. Follow Microsoft’s linked update instructions; the security update requires a restart.
Credit
Microsoft credits Rocco Calvi (@TecR0c) and Edward Morris (edwardgmorris.com) with TecSecurity.
Disclosure timeline
- Microsoft published the advisory and security update
References