Weak Authentication in Microsoft Exchange Server Subscription Edition RTM - CVE-2026-118157
Published: November 11, 2026
Vulnerability identifier: #VU165054
CSH Severity: Low
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-118157
CWE-ID: CWE-1390
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote privileged user to escalate privileges and compromise the confidentiality, integrity, and availability of the server.
The vulnerability exists due to weak authentication in Microsoft Exchange Server when handling authentication over a network. A remote privileged user can exploit the authentication weakness to elevate privileges and gain unauthorized control over server data and operations.
Affected software
Microsoft Exchange Server Subscription Edition RTM
How to mitigate CVE-2026-118157
Install security update from vendor's website.
Microsoft Exchange Server Subscription Edition RTM - update to 15.02.2562.057