SB2026101411 - Multiple vulnerabilities in Microsoft Exchange Server

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026101411

SB2026101411 - Multiple vulnerabilities in Microsoft Exchange Server

Published: October 14, 2026

Security Bulletin ID SB2026101411
CSH Severity
High
Patch available
YES
Number of vulnerabilities 6
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

High 17% Medium 33% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 6 vulnerabilities.


1) Cross-site scripting (CVE-ID: CVE-2026-70279)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: 5.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N]


The vulnerability allows a remote attacker to execute arbitrary scripts in a victim's browser.

The vulnerability exists due to improper neutralization of input during web page generation in Microsoft Exchange Server when generating web content. A remote attacker can send a specially crafted link and persuade a user to open it to execute arbitrary scripts in the victim's browser.

If the victim has administrative privileges, exploitation could allow actions using those privileges, potentially enabling access to or modification of organizational data.


2) Stack-based buffer overflow (CVE-ID: CVE-2026-70571)

CWE-ID: CWE-121 - Stack-based buffer overflow

CVSSv4: 9.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to execute arbitrary code on the server.

The vulnerability exists due to a stack-based buffer overflow in the internal content-conversion process of Microsoft Exchange Server when processing specially crafted emails. A remote attacker can send a specially crafted email to an affected server to execute arbitrary code on the server.

User interaction is not required. Successful exploitation requires a deep understanding of the target environment and depends on environmental factors, system configuration, and additional security measures.


3) Incorrect authorization (CVE-ID: CVE-2026-77910)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges in another user's mailbox context.

The vulnerability exists due to incorrect authorization in Microsoft Exchange Server when using a shared cache for Exchange Control Panel operations. A remote user can poison the shared cache to cause a malicious mail add-in to be installed in another user's mailbox and to escalate privileges in that mailbox context.

User interaction is not required.


4) Deserialization of Untrusted Data (CVE-ID: CVE-2026-87692)

CWE-ID: CWE-502 - Deserialization of Untrusted Data

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to deserialization of untrusted data in Microsoft Exchange Server when processing untrusted serialized data. A local user can exploit this deserialization flaw to escalate privileges to SYSTEM.


5) Inclusion of Functionality from Untrusted Control Sphere (CVE-ID: CVE-2026-87695)

CWE-ID: CWE-829 - Inclusion of Functionality from Untrusted Control Sphere

CVSSv4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a local user to escalate privileges to SYSTEM.

The vulnerability exists due to inclusion of functionality from an untrusted control sphere in Microsoft Exchange Server when incorporating untrusted functionality. A local user can exploit this behavior locally to escalate privileges to SYSTEM.


6) Improper Verification of Cryptographic Signature (CVE-ID: CVE-2026-87696)

CWE-ID: CWE-347 - Improper Verification of Cryptographic Signature

CVSSv4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges in another user's mailbox context.

The vulnerability exists due to improper verification of cryptographic signatures in Microsoft Exchange Server when installing mail add-ins through the Exchange Control Panel. A remote user can poison a shared cache to install a malicious mail add-in and gain elevated privileges in another user's mailbox context.

User interaction is not required. Successful exploitation requires a deep understanding of the system and depends on environmental and configuration factors.


Remediation

Install update from vendor's website.

References