Skip to main content

Microsoft Exchange Server CVE-2026-62910

| EUVDEUVD-2026-56413 HIGH
Improper Control of Resource Identifiers ('Resource Injection') (CWE-99)
2026-08-11 secure@microsoft.com GHSA-qf6w-r299-vghv
Code Injection Microsoft Exchange Server Exchange Server Subscription Edition
8.8
CVSS 3.1 · NVD
Share

Severity by source

Vendor (microsoft) PRIMARY
HIGH
qualitative
NVD
8.8 HIGH
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
vuln.today AI
8.8 HIGH

PR:L reflects the confirmed authenticated requirement; AV:N and AC:L consistent with a network-accessible endpoint requiring no special setup; full C/I/A from privilege escalation reaching administrative access.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector
Network
Attack Complexity
Low
Privileges Required
Low
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High

Lifecycle Timeline

6
Analysis Updated
Aug 14, 2026 - 15:44 vuln.today
v2 (cvss_changed)
Re-analysis Queued
Aug 14, 2026 - 15:37 vuln.today
cvss_changed
CVSS changed
Aug 14, 2026 - 15:37 NVD
7.2 (HIGH) 8.8 (HIGH)
Analysis Generated
Aug 11, 2026 - 18:57 vuln.today
Patch available
Aug 11, 2026 - 18:19 EUVD
CVE Published
Aug 11, 2026 - 17:18 nvd
HIGH 7.2

DescriptionNVD

Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Exchange Server 2016, 2019, and Subscription Edition allows authenticated network attackers to gain elevated privileges through resource injection (CWE-99), earning a CVSS 8.8 High rating with total technical impact across confidentiality, integrity, and availability. Affected deployment tracks span Exchange 2016 CU23 (below 15.01.2507.072), Exchange 2019 CU14 and CU15, and Exchange SE RTM, with vendor patches confirmed available for all tracks. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
technique details hidden
Delivery
technique details hidden
Exploit
technique details hidden
Execution
technique details hidden
Persist
technique details hidden
Impact
technique details hidden
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Exploitation requires a valid, authenticated Exchange user session - CVSS PR:L confirms that low-privileged credentials are sufficient, meaning any standard Exchange mailbox account meets this prerequisite. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS 8.8 High vector (AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H) presents a serious posture: network-accessible, low-complexity exploitation by any low-privileged authenticated user, yielding total impact across all three security pillars. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario Full exploit scenario with step-by-step reproduction available after sign-in.
Remediation Apply vendor-released patches immediately, as Microsoft has confirmed patch availability for all affected tracks. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours, inventory all Exchange deployments to identify instances running Exchange 2016 CU23 (before version 15.01.2507.072), Exchange 2019 CU14 or CU15, or Exchange Subscription Edition RTM. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Exchange Server

View all
CVE-2021-34473 CRITICAL POC
9.1 Jul 14

Microsoft Exchange Server contains a pre-authentication SSRF vulnerability known as 'ProxyShell' that allows unauthentic
CVE-2021-26855 CRITICAL POC
9.1 Mar 03

Microsoft Exchange Server contains a server-side request forgery (SSRF) vulnerability known as 'ProxyLogon' that allows

CVE-2021-34523 CRITICAL POC
9.0 Jul 14

Microsoft Exchange Server contains a privilege escalation vulnerability in the PowerShell backend that allows authentica
CVE-2021-27065 HIGH POC
7.8 Mar 03

Microsoft Exchange Server allows post-authentication arbitrary file write that enables web shell deployment, the primary
CVE-2021-42321 HIGH POC
8.8 Nov 10

Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is rem
CVE-2021-33766 HIGH POC
7.3 Jul 14

Microsoft Exchange Server Information Disclosure Vulnerability. Rated high severity (CVSS 7.3), this vulnerability is re
CVE-2022-41080 HIGH
8.8 Nov 09

Microsoft Exchange Server Elevation of Privilege Vulnerability. Rated high severity (CVSS 8.8), this vulnerability is re
CVE-2021-26858 HIGH
7.8 Mar 03

Microsoft Exchange Server allows authenticated attackers to write arbitrary files to the server filesystem, the third co
CVE-2023-21529 HIGH POC
8.8 Feb 14

Remote code execution in Microsoft Exchange Server 2013, 2016, and 2019 allows authenticated attackers to execute arbitr
CVE-2021-41349 MEDIUM POC
6.5 Nov 10

Microsoft Exchange Server Spoofing Vulnerability. Rated medium severity (CVSS 6.5), this vulnerability is remotely explo
CVE-2021-26857 HIGH
7.8 Mar 03

Microsoft Exchange Server Unified Messaging service contains a deserialization vulnerability that allows authenticated a
CVE-2021-31196 HIGH
7.2 Jul 14

Microsoft Exchange Server Remote Code Execution Vulnerability. Rated high severity (CVSS 7.2), this vulnerability is rem

Same weakness CWE-99 – Improper Control of Resource Identifiers ('Resource Injection')

View all
CVE-2022-3774 CRITICAL POC
9.1
CVE-2024-4294 HIGH POC
8.8
CVE-2023-2980 HIGH POC
8.8
CVE-2021-22879 HIGH POC
8.8
CVE-2020-8177 HIGH POC
7.8
CVE-2019-6545 HIGH POC
7.5
CVE-2017-5159 CRITICAL
9.8
CVE-2022-1287 CRITICAL
9.8

Same technique Code Injection

View all
CVE-2023-3519 CRITICAL POC
9.8
CVE-2021-22205 CRITICAL POC
10.0
CVE-2024-23692 CRITICAL POC
9.8
CVE-2012-0158 HIGH POC
8.8
CVE-2021-44529 CRITICAL POC
9.8
CVE-2014-6287 CRITICAL POC
9.8
CVE-2017-7494 CRITICAL POC
9.8
CVE-2025-24893 CRITICAL POC
9.8

Share

CVE-2026-62910 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy