EUVD-2026-44025
GHSA-hxvf-rh49-68gj
Severity by source
AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Local privilege escalation from an existing low-privileged authenticated context (AV:L, PR:L, AC:L, UI:N) yielding full host compromise, so C/I/A all High with unchanged scope.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
2DescriptionCVE.org
Insufficient granularity of access control in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
AnalysisAI
Local privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) allows an authenticated attacker with low-level privileges on the server to elevate to higher privileges due to insufficiently granular access controls (CWE-1220). The CVSS 3.1 score of 7.8 (AV:L/AC:L/PR:L) reflects local exploitation yielding full confidentiality, integrity, and availability impact. A vendor patch is available; there is no public exploit identified at time of analysis and the flaw is not listed in CISA KEV.
Technical ContextAI
Microsoft Exchange Server is a widely deployed on-premises messaging and collaboration platform whose services run with elevated system privileges and enforce authorization boundaries across mailbox, transport, and administrative roles. The root cause is classified as CWE-1220 (Insufficient Granularity of Access Control), meaning the product enforces access at too coarse a level, so an operation available to a lower-privileged role also exposes actions or objects that should require a higher privilege tier. Per the affected CPE strings, this spans microsoft_exchange_server_2016_cumulative_update_23, 2019_cumulative_update_14, 2019_cumulative_update_15, and the Subscription_Edition_rtm builds, indicating the weak authorization logic is shared across the current supported Exchange codebase rather than a single release.
RemediationAI
Apply the Microsoft security update for your build as documented in the vendor advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55006 - a patch is available per Microsoft for Exchange Server 2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM. Exact fixed build numbers should be taken directly from the MSRC page for your specific Cumulative Update, as the input does not enumerate them. Because exploitation is local and requires an existing authenticated foothold, effective compensating controls until patching include restricting and monitoring interactive and low-privilege access to Exchange servers, enforcing least-privilege on Exchange administrative and mailbox roles, and auditing for unexpected privilege elevation on the host; the trade-off is operational overhead and no substitute for the vendor fix. Ensure servers are first brought to the required baseline Cumulative Update, since Microsoft security updates are cumulative-update-specific.
Cross-site scripting (XSS) in Microsoft Exchange Server enables remote attackers to spoof content and steal credentials
Stored/reflected cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition
Remote code execution in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets an aut
Local privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) allows
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today