Microsoft Exchange Server CVE-2026-55005

Exploitation requires the attacker to hold valid low-privilege authentication to the Exchange Server (CVSS PR:L), reachable over the network (AV:N), with no user interaction needed (UI:N) and low attack complexity (AC:L). The concrete prerequisite is an authenticated foothold - such as a compromised or attacker-owned mailbox/domain account able to reach an Exchange network service - after which the crafted input triggers the heap overflow. Limiting factors: the authentication requirement blocks purely anonymous internet attackers, exploitation targets the on-premises builds listed (Exchange 2016 CU23, 2019 CU14/CU15, Subscription Edition RTM), and the internal service endpoint must be network-reachable from the attacker's position.

The CVSS base score of 8.8 (High) reflects a network attack vector, low attack complexity, no user interaction, and only low privileges required, with high impact to all three security properties - a genuinely serious combination for an internet-adjacent mail server. However, PR:L means the attacker must already hold at least a low-privilege authenticated foothold (e.g., a valid mailbox account), which meaningfully raises the bar versus a pre-auth flaw. No EPSS score was provided, so probabilistic exploitation likelihood cannot be quantified, and no SSVC decision data was supplied. It is not in CISA KEV and no POC is referenced, so there is no evidence of active or automated exploitation yet; nonetheless, Exchange is a historically high-value, heavily-targeted target, so patching should be prioritized despite the authentication precondition. No data conflicts were observed between the CVSS vector and the description - both consistently indicate authenticated network code execution.

An attacker who has obtained or been granted a low-privilege Exchange mailbox account sends a crafted request to a network-facing Exchange service, triggering the heap-based buffer overflow and executing code in the server's context. Because no user interaction is required and attack complexity is low, a single authenticated session is sufficient; no public POC is currently identified, so a working exploit would need to be developed.