Microsoft Exchange Server CVE-2026-55006

Exploitation requires local access to the Exchange server host with an existing low-privilege authenticated context (CVSS PR:L, AV:L) and no user interaction (UI:N). The concrete prerequisite is that the attacker must already be able to run in an authorized-but-lower-privileged context on an affected on-premises build (Exchange 2016 CU23, 2019 CU14/CU15, or Subscription Edition RTM); the insufficiently granular access control then lets that context reach higher-privileged operations. Limiting factors: it cannot be triggered remotely without first establishing that local foothold, it does not apply to Exchange Online, and it is bounded to the enumerated Cumulative Update levels. The exact product feature or role boundary that is under-segmented is not specified in the available description and should be confirmed against the MSRC advisory.

The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8) describes a locally exploitable, low-complexity escalation that requires the attacker to already hold some authenticated foothold (PR:L) but no user interaction, delivering full high impact on the host. Because the attack vector is Local, this is not a remote-unauthenticated worm scenario - it is a second-stage escalation useful after an attacker has already gained a low-privilege account or code execution on the Exchange server. No EPSS score, KEV listing, or POC was provided in the input, so real-world exploitation probability cannot be quantified from the data; the absence of KEV suggests no confirmed active exploitation at this time. Given Exchange's high value as a target and Microsoft's own reporting, this warrants prompt patching, though it ranks below any concurrent remote-unauthenticated Exchange flaw. Note: EPSS and POC status are absent from the input and cannot be inferred.

An attacker who has already obtained a low-privileged authenticated account or limited code execution on an Exchange server - for example via a compromised service account or a prior foothold - abuses the coarse access-control check to perform an operation reserved for a higher privilege level, escalating to full control of the mail server. Given AC:L this requires no special timing or race conditions. No public proof-of-concept was identified in the provided data.