EUVD-2026-73128
GHSA-hp6f-8h4f-5pjq
Severity by source
AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Network-reachable with no auth or interaction required; impact is availability-only (process crash), no confidentiality or integrity loss.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
4DescriptionCVE.org
Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.
AnalysisAI
Uncontrolled recursion (CWE-674) in Microsoft Exchange Server enables remote unauthenticated attackers to crash or hang the service, resulting in a complete denial of availability across all affected Exchange versions from 2016 CU23 through the current Subscription Edition. The vulnerability requires no authentication, no user interaction, and no special network position - any attacker with TCP access to the Exchange endpoint can trigger the condition. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | No special conditions are required beyond network-layer access to the Exchange Server - the CVSS vector is AV:N/AC:L/PR:N/UI:N, confirming that exploitation requires no authentication, no user interaction, and no non-default configuration. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 7.5 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H) accurately reflects the threat model: the attack is trivially automatable, requires zero authentication, and is reachable from any network path to the Exchange server - meaning even a mid-sized municipal IT team should treat this as urgent patching work. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Microsoft has released patches for all affected branches. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory all Microsoft Exchange Server instances in production and document their versions to identify which systems fall within the vulnerable range (2016 CU23 and later through Subscription Edition). …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Same weakness CWE-674 – Uncontrolled Recursion
View allShare
External POC / Exploit Code
Leaving vuln.today