Published advisory · CVE-2026-118151
CVE-2026-118151 - Microsoft Exchange Server Elevation of Privilege Vulnerability
AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H Vulnerability analysis
An authenticated attacker with high privileges can influence a file name or path used by Microsoft Exchange Server and elevate privileges over the network. Microsoft classifies the weakness as CWE-73 and states that successful exploitation can grant SYSTEM privileges. No user interaction is required.
Affected Versions
Microsoft identifies Exchange Server Subscription Edition RTM on x64 systems as affected, from build 15.02.0.0 up to, but excluding, 15.02.2562.057.
Solution / Mitigation
Install the Exchange Server security update KB5133453, which provides fixed build 15.02.2562.057, or a superseding security update. Follow Microsoft’s linked update instructions; the security update requires a restart.
Credit
Microsoft credits Rocco Calvi (@TecR0c) and Edward Morris (edwardgmorris.com) with TecSecurity, and also acknowledges Cassio Lima with SEK.
Disclosure timeline
- Microsoft published the advisory and security update
References