Inclusion of Functionality from Untrusted Control Sphere in Microsoft Exchange Server and Microsoft Exchange Server Subscription Edition RTM - CVE-2026-87695
Published: October 14, 2026
Vulnerability identifier: #VU155260
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-87695
CWE-ID: CWE-829
Exploitation vector: Local access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a local user to escalate privileges to SYSTEM.
The vulnerability exists due to inclusion of functionality from an untrusted control sphere in Microsoft Exchange Server when incorporating untrusted functionality. A local user can exploit this behavior locally to escalate privileges to SYSTEM.
Affected software
Microsoft Exchange Server
Microsoft Exchange Server Subscription Edition RTM
Microsoft Exchange Server Subscription Edition RTM
How to mitigate CVE-2026-87695
Install security update from vendor's website.
Microsoft Exchange Server - addressed in versions 15.01.2507.077, 15.02.1544.050, 15.02.1748.055
Microsoft Exchange Server Subscription Edition RTM - update to 15.02.2562.056
Microsoft Exchange Server Subscription Edition RTM - update to 15.02.2562.056