Microsoft Exchange Server CVE-2026-55009

Patch available per vendor advisory: apply the Microsoft security update for your Exchange build as documented at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55009 - the exact patched CU/SU version was not included in the provided data, so pull the specific update package for Exchange 2016 CU23, 2019 CU14, 2019 CU15, or Subscription Edition RTM from the MSRC page and verify build numbers before deployment. Because this is a local privilege-escalation vulnerability, compensating controls until patching include tightly restricting who can log on to or run code on Exchange servers (limit membership of local Administrators and Exchange management roles, enforce least privilege for service and delegated accounts), and enabling Windows Extended Protection and RBAC hardening per Microsoft's Exchange security guidance to shrink the set of accounts that could reach the vulnerable code path; the trade-off is added operational friction for administrators and third-party integrations that legitimately need elevated access. As a monitoring control, alert on unexpected process creation or SYSTEM-level activity spawned from Exchange worker processes, accepting that this is detection rather than prevention.