What is the CVSS score of CVE-2026-55005?

CVE-2026-55005 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Microsoft Exchange Server are affected by CVE-2026-55005?

Microsoft Exchange Server versions 2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM contain a remote code execution vulnerability allowing authenticated users to execute arbitrary code on mail…. A patch is available.

How to fix or mitigate CVE-2026-55005?

Within 24 hours, identify and inventory all Exchange Server instances across your environment, prioritizing those running the affected versions (2016 CU23, 2019 CU14/CU15, SE RTM). Within 7 days, apply the available vendor patch to all affected systems in a controlled sequence, beginning with non-production environments. Within 30 days, complete production patching across all remaining systems and conduct verification testing to confirm successful remediation and normal service operation.

Microsoft Exchange Server CVE-2026-55005

EUVD-2026-44024 HIGH

Heap-based Buffer Overflow (CWE-122)

2026-07-14 microsoft

GHSA-6m3r-w7v9-p35g

Buffer Overflow Heap Overflow Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 Microsoft Exchange Server 2019 Cumulative Update 14 Microsoft Exchange Server 2019 Cumulative Update 15 Microsoft Exchange Server Subscription Edition Rtm

8.8

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

ENISA EUVD

HIGH

qualitative

vuln.today AI

8.8 HIGH

Network-reachable service exploitable with a low-privilege authenticated account and no user interaction, yielding full code execution and thus high C/I/A on an unchanged scope.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorVendor: microsoft

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 18:00 vuln.today

CVE Published

Jul 14, 2026 - 17:04 nvd

HIGH 8.8

DescriptionCVE.org

Heap-based buffer overflow in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

AnalysisAI

Remote code execution in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets an authenticated attacker corrupt heap memory to run arbitrary code across the network. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) shows low-privilege network exploitation with full confidentiality, integrity, and availability impact, and Microsoft has released a patch. There is no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

The flaw is a CWE-122 heap-based buffer overflow, meaning a buffer allocated on the heap is written past its bounds, corrupting adjacent heap metadata or objects and enabling attacker-controlled memory to influence execution flow. It resides in Microsoft Exchange Server, the on-premises enterprise mail and calendaring platform that exposes numerous network-facing services (OWA, EWS, autodiscover, transport). The CPE data pins the affected code to Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Update 14 and 15, and the newer Exchange Server Subscription Edition RTM, indicating the vulnerable component is shared across the current supported servicing baselines rather than a single legacy build.

RemediationAI

Apply the Microsoft security update for CVE-2026-55005 as published in the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55005 (Patch available per vendor advisory); install the corresponding fixed cumulative-update or security-update package for your specific build - Exchange 2016 CU23, Exchange 2019 CU14 or CU15, or Exchange Server Subscription Edition RTM. The advisory does not expose a single independently-confirmed fixed version string here, so pull the exact SU/CU build from MSRC for your servicing level before deployment. As compensating controls until patching, restrict which accounts can authenticate to Exchange and tighten mailbox account hygiene (since exploitation requires low-privilege authentication), place OWA/EWS behind a VPN or reverse proxy with pre-authentication to limit reachable attack surface, and enforce MFA to reduce the pool of usable low-privilege credentials - noting these controls reduce but do not eliminate risk for any attacker who already holds valid credentials, and proxy/VPN gating may disrupt legitimate mobile or federated access.