Vulnerability · Published Aug 11, 2026 · Assigned by microsoft
CVE-2026-62911Microsoft Exchange Server Elevation of Privilege Vulnerability
High 8.0
In plain English
A high-severity security flaw in Microsoft Exchange Server 2016 Cumulative Update 23 from Microsoft. Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 53% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 3.1)8.0High
Exploit odds (30 days)0.7%top 46.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: poc
Attack tooling1Public PoC
Official description
Authentication bypass by capture-replay in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 23 | 15.01.0.0 – before 15.01.2507.072 |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 14 | 15.02.0.0 – before 15.02.1544.044 |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 15 | 15.02.0.0 – before 15.02.1748.049 |
| Microsoft | Microsoft Exchange Server Subscription Edition RTM | 15.02.0.0 – before 15.02.2562.046 |
Weakness: CWE-294 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
References
- Microsoft Exchange Server Elevation of Privilege Vulnerability vendor-advisory, patch
- https://github.com/hypnguyen1209/CVE-2026-62911 exploit