Microsoft Exchange Server CVE-2026-55009

Exploitation requires the attacker to already possess low-level authenticated access to the affected Exchange host (PR:L) and local reach to the vulnerable process (AV:L), and to be running one of the affected on-premises builds: Exchange 2016 CU23, 2019 CU14, 2019 CU15, or Subscription Edition RTM. No user interaction is needed (UI:N) and complexity is low (AC:L), so once a low-privilege foothold exists, escalation is straightforward. Limiting factors that reduce real-world risk: the attacker cannot exploit this purely remotely without first authenticating or gaining local execution, Exchange Online is not indicated as affected, and hosts already patched to the fixed build are not exploitable; the primary elevated concern is internet-facing Exchange where this EoP can be chained to a separate remote entry point.

The CVSS 3.1 vector CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H describes a local attack (AV:L) of low complexity (AC:L) requiring some existing low-level privileges (PR:L) and no user interaction, yielding high confidentiality, integrity, and availability impact within an unchanged scope. This is a privilege-escalation primitive, not a remote pre-auth compromise, so an attacker must already have a foothold on or authenticated access to the Exchange host. No EPSS score was provided and the CVE is not present in CISA KEV, so there is no evidence of active exploitation; likewise no POC was supplied, meaning this is best treated as a real but not emergency priority. However, deserialization flaws in Exchange have a strong track record of being chained with remote entry points, so on internet-facing Exchange this should be prioritized above a typical local EoP. The signals are internally consistent (local vector matches an EoP description); the main missing data are EPSS probability and independent confirmation of the exact patched build numbers.

An attacker who already holds a low-privileged authenticated foothold on an Exchange server - for example a compromised service account, a limited management-role user, or a follow-on stage after a separate remote bug - supplies a crafted serialized payload to a vulnerable Exchange deserialization path. Because the attack is local, low-complexity, and requires no user interaction, the malicious object graph is deserialized and abused to run code or operations at a higher privilege level, giving the attacker full control of the mail environment. No public exploit identified at time of analysis, so this scenario is inferred from the CVSS vector and CWE-502 rather than a released POC.