What is the CVSS score of CVE-2026-45583?

CVE-2026-45583 has a CVSS 3.1 base score of 7.5 (High). CVSS vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Microsoft Exchange Server are affected by CVE-2026-45583?

Microsoft Exchange Server is vulnerable to unauthenticated remote code execution that could allow attackers to compromise email systems and access sensitive organizational communications.. A patch is available.

How to fix or mitigate CVE-2026-45583?

Within 24 hours: Conduct inventory of all Microsoft Exchange Server deployments and versions; enable enhanced audit logging on Exchange services; restrict Exchange network access via firewall to only required personnel; brief incident response team on user-interaction exploitation scenario. Within 7 days: Implement network segmentation isolating Exchange infrastructure from general network access; enforce multi-factor authentication for all mail client connections; publish internal guidance on phishing and social engineering given the user-interaction requirement; acquire and deploy intrusion detection signatures from security vendors. Within 30 days: Monitor Microsoft Security Update Guide for patch availability; develop and test patch deployment procedures in advance; validate effectiveness of all compensating controls; conduct full vulnerability assessment of current Exchange configuration.

Microsoft Exchange Server CVE-2026-45583

EUVD-2026-35681 HIGH

Code Injection (CWE-94)

2026-06-09 secure@microsoft.com

GHSA-2qq9-7ppw-4m9q

Code Injection Microsoft RCE

7.5

CVSS 3.1 · NVD

Temporal: 6.5

Severity by source

NVD PRIMARY

7.5 HIGH

AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

CIRCL (temporal)

6.5 MEDIUM

cvss

Primary rating from NVD.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Attack Vector

Network

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Patch available

Jun 09, 2026 - 19:03 EUVD

Analysis Generated

Jun 09, 2026 - 18:16 vuln.today

CVE Published

Jun 09, 2026 - 17:17 nvd

HIGH 7.5

DescriptionCVE.org

Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Exchange Server allows an unauthenticated network-based attacker to execute arbitrary code on the mail server through code injection, though successful exploitation requires user interaction and faces high attack complexity. No public exploit identified at time of analysis, and the issue is not currently listed in CISA KEV. The vulnerability is rated CVSS 7.5 with full confidentiality, integrity, and availability impact on a compromised Exchange host.

Technical ContextAI

The flaw is classified under CWE-94 (Improper Control of Generation of Code, commonly known as code injection), meaning untrusted input is incorporated into a code construct that the Exchange Server subsequently interprets or executes. Microsoft Exchange Server is an enterprise messaging platform exposing SMTP, OWA, EWS, MAPI/HTTP, and PowerShell remoting endpoints, any of which can become an injection surface when input parsers feed values into dynamic code paths such as scripting engines, deserializers, or template processors. The references point only to Microsoft's MSRC update guide entry, and no specific subsystem or affected build is enumerated in the supplied data, but CWE-94 in Exchange historically maps to PowerShell, .NET deserialization, or transport-rule expression evaluation paths.

RemediationAI

No vendor-released patch version is identified in the supplied data, so the primary action is to consult Microsoft's MSRC update guide entry at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-45583 and apply the security update or cumulative update Microsoft lists for each affected Exchange Server build as soon as it is published. Until patching, restrict external exposure of OWA, ECP, EWS, and PowerShell remoting endpoints to VPN or trusted networks only (which will reduce remote attack surface but will also block legitimate remote users and mobile clients), enforce admin MFA and minimize the number of accounts that can interact with administrative web pages or open inbound mail attachments (since UI:R is part of the chain), and ensure Exchange anti-malware/transport scanning and EDR with Exchange-aware detections are enabled to flag suspicious child processes spawned by w3wp.exe, EdgeTransport.exe, or PowerShell.