What is the CVSS score of CVE-2026-45583?

CVE-2026-45583 has a CVSS 3.1 base score of 8.1 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Exchange Server are affected by CVE-2026-45583?

A remote code injection vulnerability in Microsoft Exchange Server (versions 2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) could allow unauthenticated attackers to execute arbitrary code…. A patch is available.

How to fix or mitigate CVE-2026-45583?

Within 24 hours, identify and document all Exchange Server instances running versions 2016 CU23, 2019 CU14/CU15, or Subscription Edition RTM in your environment. Within 7 days, apply the vendor-released patch from Microsoft and validate installation across all affected systems. Within 30 days, conduct a comprehensive vulnerability scan to confirm remediation and review Exchange access logs for any exploitation attempts.

Microsoft Exchange Server CVE-2026-45583

EUVD-2026-35681 HIGH

Code Injection (CWE-94)

2026-06-09 secure@microsoft.com

GHSA-2qq9-7ppw-4m9q

Code Injection Microsoft RCE Exchange Server Exchange Server Subscription Edition

8.1

CVSS 3.1 · NVD

Temporal: 6.5

Severity by source

NVD PRIMARY

8.1 HIGH

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.5 MEDIUM

cvss

vuln.today AI

8.1 HIGH

Unauthenticated remote code injection (AV:N/PR:N/UI:N) with total impact (C/I/A:H); AC:H retained because SSVC 'not automatable' and vendor rating imply non-trivial preconditions.

3.1 AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from NVD.

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Jul 23, 2026 - 08:30 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Jul 23, 2026 - 08:22 vuln.today

cvss_changed

CVSS changed

Jul 23, 2026 - 08:22 NVD

7.5 (HIGH) 8.1 (HIGH)

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:16 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.5

DescriptionNVD

Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code injection in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets an unauthenticated network attacker execute arbitrary code on the mail server, per CVSS 8.1 (AV:N/PR:N) and CWE-94. Microsoft (secure@microsoft.com) has released fixes, but the CVSS AC:H rating and SSVC 'Automatable: no' assessment indicate exploitation is non-trivial rather than push-button. There is no public exploit identified at time of analysis, and EPSS is low at 0.08% (23rd percentile).

Technical ContextAI

The affected component is Microsoft Exchange Server, the on-premises enterprise messaging platform exposing network surfaces such as Outlook Web Access, ECP, EWS, and transport. The root cause is CWE-94, improper control of code generation ('code injection'), where attacker-influenced input is incorporated into a code/execution context that the server later evaluates, yielding arbitrary code execution rather than mere data disclosure. CPE data confirms the affected code base spans the 15.01.x (Exchange 2016 CU23) and 15.02.x (Exchange 2019 CU14/CU15 and Subscription Edition RTM) trains, all sharing the same underlying managed Exchange server stack.

RemediationAI

Apply the Microsoft security update for your servicing train to reach the fixed builds: Exchange 2016 CU23 to 15.01.2507.069 or later, Exchange 2019 CU14 to 15.02.1544.041, Exchange 2019 CU15 to 15.02.1748.046, and Exchange Server Subscription Edition to 15.02.2562.043, following the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45583 (patch confirmed available from vendor). Exchange updates must be installed from an elevated context and typically require running setup/Health Checker and reapplying the update on every Exchange role, so schedule a maintenance window and ensure all servers in a DAG are patched to avoid mixed-version coexistence issues. As interim compensating controls where immediate patching is impossible, restrict and monitor external access to Exchange web surfaces (OWA/ECP/EWS) via reverse proxy or firewall ACLs, enforce Exchange Emergency Mitigation Service (EEMS) rules if Microsoft publishes them, and increase monitoring for anomalous w3wp.exe or PowerShell child processes on Exchange hosts; note that locking down ECP/EWS can break legitimate remote administration and some client features. Additional references: https://vuldb.com/vuln/369698 and https://nvd.nist.gov/vuln/detail/CVE-2026-45583.