SB2026111136 - Multiple vulnerabilities in Microsoft Exchange Server Subscription Edition RTM

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026111136

SB2026111136 - Multiple vulnerabilities in Microsoft Exchange Server Subscription Edition RTM

Published: November 11, 2026

Security Bulletin ID SB2026111136
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 9
Exploitation vector Remote access
Highest impact Code execution

Breakdown by Severity

Medium 67% Low 33%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 9 vulnerabilities.


1) Code Injection (CVE-ID: CVE-2026-118149)

CWE-ID: CWE-94 - Improper Control of Generation of Code ('Code Injection')

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code on the target system.

The vulnerability exists due to improper control of code generation in Microsoft Exchange Server when handling network requests. A remote user can send a specially crafted request to an affected service to execute arbitrary code on the target system.


2) Authorization bypass through user-controlled key (CVE-ID: CVE-2026-118150)

CWE-ID: CWE-639 - Authorization Bypass Through User-Controlled Key

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges in Microsoft Exchange Server.

The vulnerability exists due to authorization bypass through a user-controlled key in Microsoft Exchange Server when handling network requests. A remote user can manipulate a key used in authorization decisions to bypass access restrictions and escalate privileges.


3) External Control of File Name or Path (CVE-ID: CVE-2026-118151)

CWE-ID: CWE-73 - External Control of File Name or Path

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to escalate privileges to SYSTEM.

The vulnerability exists due to external control of file names or paths in Microsoft Exchange Server when handling externally supplied file names or paths. A remote privileged user can manipulate a file name or path used by the server to gain SYSTEM privileges.


4) Cross-site request forgery (CVE-ID: CVE-2026-118152)

CWE-ID: CWE-352 - Cross-Site Request Forgery (CSRF)

CVSSv4: 6.7 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to perform spoofing by causing unauthorized actions in a victim's session.

The vulnerability exists due to insufficient protection against cross-site request forgery in Microsoft Exchange Server when processing requests originating from another site. A remote attacker can trick a victim into interacting with malicious content that submits forged requests to perform unauthorized actions under the victim's identity.


5) Inefficient Algorithmic Complexity (CVE-ID: CVE-2026-118153)

CWE-ID: CWE-407 - Inefficient Algorithmic Complexity

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to inefficient algorithmic complexity in Microsoft Exchange Server when processing network input. A remote attacker can send specially crafted network input to trigger excessive computational resource consumption and cause a denial of service.


6) Reliance on Untrusted Inputs in a Security Decision (CVE-ID: CVE-2026-118154)

CWE-ID: CWE-807 - Reliance on Untrusted Inputs in a Security Decision

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to escalate privileges in Microsoft Exchange Server.

The vulnerability exists due to reliance on untrusted inputs in a security decision in Microsoft Exchange Server when handling network requests. A remote user can supply untrusted input that influences a security decision to escalate privileges.


7) Weak Authentication (CVE-ID: CVE-2026-118157)

CWE-ID: CWE-1390 - Weak Authentication

CVSSv4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote privileged user to escalate privileges and compromise the confidentiality, integrity, and availability of the server.

The vulnerability exists due to weak authentication in Microsoft Exchange Server when handling authentication over a network. A remote privileged user can exploit the authentication weakness to elevate privileges and gain unauthorized control over server data and operations.


8) Use of Incorrectly-Resolved Name or Reference (CVE-ID: CVE-2026-118207)

CWE-ID: CWE-706 - Use of Incorrectly-Resolved Name or Reference

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to execute arbitrary code on the affected server.

The vulnerability exists due to incorrect name or reference resolution in Microsoft Exchange Server when handling network requests. A remote user can send a specially crafted request to execute arbitrary code on the server.


9) Improper access control (CVE-ID: CVE-2026-118208)

CWE-ID: CWE-284 - Improper Access Control

CVSSv4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N]


The vulnerability allows a remote user to perform spoofing over a network.

The vulnerability exists due to improper access control in Microsoft Exchange Server when handling network requests. A remote user can send crafted requests to bypass access restrictions and perform spoofing.


Remediation

Install update from vendor's website.

References