Microsoft Exchange Server CVE-2026-62913

Exploitation requires the attacker to hold a valid, authenticated Exchange account with at minimum low-privilege access (PR:L per CVSS vector) - anonymous or unauthenticated exploitation is not indicated. The attack is conducted over the network (AV:N) with no required user interaction (UI:N) and low complexity (AC:L), meaning no special non-default configuration or race condition is required beyond network reachability to the Exchange server and possession of credentials. The key limiting factor is authentication: attackers without any valid Exchange credentials cannot exploit this directly. In practice, enterprises with large Exchange user populations or externally federated environments face a materially lower effective barrier. No specific feature flag, protocol mode, or configuration setting is identified in available data as a prerequisite beyond standard Exchange operation.

The CVSS 3.1 score of 8.8 is substantiated by the vector AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H - network-exploitable, low complexity, requiring only a low-privileged account, with no user interaction and full confidentiality, integrity, and availability impact. The principal risk limiter is PR:L: exploitation is not anonymous. However, in enterprise Exchange deployments the authenticated user population is typically large and includes external contractors and federated partners, meaning the effective barrier is low. No EPSS probability score is available in provided data, and KEV status is unconfirmed - no active exploitation has been established at time of analysis. Microsoft Exchange has historically been a high-value target for nation-state and ransomware actors (e.g., ProxyLogon, ProxyShell), which elevates prioritization of this class of flaw even absent confirmed in-the-wild exploitation. Patch versions are specific and available, removing ambiguity around remediation scope.

An attacker possessing any valid low-privileged Exchange mailbox account - such as a standard employee account or compromised contractor credential - sends a specially crafted network request to an exposed Exchange endpoint. The malformed input triggers the heap-based buffer overflow in the Exchange process, corrupting adjacent heap memory structures and redirecting execution to attacker-controlled code. No public exploit code has been identified at time of analysis, but the low attack complexity (AC:L) suggests the overflow condition is reliably reproducible once the affected parsing path is identified.