Microsoft Exchange Server CVE-2026-45583

Exploitation targets an on-premises Exchange server whose web/network-facing services are reachable by the attacker; per CVSS the attack is unauthenticated (PR:N), requires no user interaction (UI:N), and is remote (AV:N), so an internet-exposed OWA/ECP/EWS endpoint is the realistic exposure. The significant limiting factor is CVSS AC:H combined with SSVC 'Automatable: no,' indicating success depends on conditions the attacker cannot always control (likely specific server state, timing, or input-shaping) rather than a single deterministic request; Exchange Online is not affected, and only the listed on-prem builds below the fixed versions are vulnerable. The exact configuration or precondition driving AC:H is not disclosed in the Microsoft/NVD description and should be treated as unverified.

Signals are mixed and lean toward patching on normal Exchange cadence rather than an emergency drop-everything response. Severity is high (CVSS 8.1) with an unauthenticated network vector (AV:N/PR:N/UI:N) and total technical impact (C:H/I:H/A:H, SSVC Technical Impact: total), which is what makes any Exchange RCE serious given its position as a high-value pivot into Active Directory. However, several signals temper urgency: CVSS marks AC:H (high attack complexity), SSVC records Exploitation: none and Automatable: no, EPSS is only 0.08% (23rd percentile), there is no KEV listing, and no public exploit is identified. The combination of AC:H plus 'not automatable' suggests exploitation requires specific conditions or effort not evident from the terse description. Key uncertainty: the Microsoft/NVD description does not disclose the precondition behind the AC:H rating, so the realistic exploitability barrier cannot be independently confirmed from available data.

An attacker who can reach an unpatched Exchange server over the network sends specially crafted input to a vulnerable request-handling surface, injecting content that the server evaluates as code and thereby executing commands in the Exchange service context. Because impact is total, the attacker can read all mailbox data, tamper with mail flow, and pivot into Active Directory. No public proof-of-concept exists at time of analysis, and the CVSS AC:H rating implies the attacker must satisfy specific, non-trivial conditions to trigger the flaw.