Microsoft has disclosed a critical (CVSS 9.1) missing authorization vulnerability in Microsoft Exchange Server that allows an authorized attacker to elevate privileges over a network.
What Is It
CVE-2026-69641 is a missing authorization weakness (CWE-862) in Microsoft Exchange Server. Per Microsoft's description, the flaw "allows an authorized attacker to elevate privileges over a network." The CVE was published on 2026-09-08 by Microsoft ([email protected]) and currently sits in NVD as "Awaiting Analysis."
Microsoft assigned a CVSS 3.1 base score of 9.1 (CRITICAL) with vector CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H.
Why It Matters
The scoring tells the story. The attack is network-reachable (AV:N) with low complexity (AC:L) and requires no user interaction (UI:N). Impact is high across confidentiality, integrity, and availability, and the scope is changed (S:C), meaning successful exploitation affects resources beyond the vulnerable component's security scope. That scope change is what pushes this into critical territory despite the high-privilege prerequisite (PR:H), which means the attacker must already hold elevated permissions before exploiting the flaw.
What's Vulnerable
Microsoft lists the following affected products, all on x64-based systems:
| Product | Fixed in build |
|---|---|
| Exchange Server 2016 Cumulative Update 23 | 15.01.2507.073 |
| Exchange Server 2019 Cumulative Update 14 | 15.02.1544.046 |
| Exchange Server 2019 Cumulative Update 15 | 15.02.1748.051 |
| Exchange Server Subscription Edition RTM | 15.02.2562.049 |
Builds below those thresholds are flagged as affected. NVD has not yet published CPE match data for this CVE.
Patch Status
The affected-version ranges above imply fixed builds are available from Microsoft. Administrators should consult the MSRC Update Guide entry for CVE-2026-69641 and bring Exchange servers up to or past the listed build numbers.
Sources
- NVD, CVE-2026-69641: https://nvd.nist.gov/vuln/detail/CVE-2026-69641
- Microsoft MSRC Update Guide: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69641