Improper Verification of Cryptographic Signature in Microsoft Exchange Server and Microsoft Exchange Server Subscription Edition RTM - CVE-2026-87696
Published: October 14, 2026
Vulnerability identifier: #VU155261
CSH Severity: Low
CVSS v4: 7.7 [CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-87696
CWE-ID: CWE-347
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to escalate privileges in another user's mailbox context.
The vulnerability exists due to improper verification of cryptographic signatures in Microsoft Exchange Server when installing mail add-ins through the Exchange Control Panel. A remote user can poison a shared cache to install a malicious mail add-in and gain elevated privileges in another user's mailbox context.
User interaction is not required. Successful exploitation requires a deep understanding of the system and depends on environmental and configuration factors.
Affected software
Microsoft Exchange Server
Microsoft Exchange Server Subscription Edition RTM
Microsoft Exchange Server Subscription Edition RTM
How to mitigate CVE-2026-87696
Install security update from vendor's website.
Microsoft Exchange Server - addressed in versions 15.01.2507.077, 15.02.1544.050, 15.02.1748.055
Microsoft Exchange Server Subscription Edition RTM - update to 15.02.2562.056
Microsoft Exchange Server Subscription Edition RTM - update to 15.02.2562.056