Incorrect authorization in Microsoft Exchange Server and Microsoft Exchange Server Subscription Edition RTM - CVE-2026-77910
Published: October 14, 2026
Vulnerability identifier: #VU154955
CSH Severity: Medium
CVSS v4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-77910
CWE-ID: CWE-863
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges in another user's mailbox context.
The vulnerability exists due to incorrect authorization in Microsoft Exchange Server when using a shared cache for Exchange Control Panel operations. A remote user can poison the shared cache to cause a malicious mail add-in to be installed in another user's mailbox and to escalate privileges in that mailbox context.
User interaction is not required.
Affected software
Microsoft Exchange Server
Microsoft Exchange Server Subscription Edition RTM
Microsoft Exchange Server Subscription Edition RTM
How to mitigate CVE-2026-77910
Install security update from vendor's website.
Microsoft Exchange Server - addressed in versions 15.01.2507.077, 15.02.1544.050, 15.02.1748.055
Microsoft Exchange Server Subscription Edition RTM - update to 15.02.2562.056
Microsoft Exchange Server Subscription Edition RTM - update to 15.02.2562.056