Microsoft Exchange Server CVE-2026-87692

Exploitation requires local access to the Exchange Server host and an existing authorized/authenticated context (CVSS PR:L) - the attacker must already be able to reach the vulnerable deserialization code path, so this is realistically a second-stage escalation after an initial foothold rather than a standalone entry point. No user interaction is required (UI:N) and attack complexity is low (AC:L), but the local vector (AV:L) means it is not exploitable directly over the network. Affected deployments are Exchange Server 2019 CU14, Exchange Server 2016 CU23, and Exchange Server Subscription Edition below the patched builds; applying the MSRC fix (2019 ≥15.02.1544.050, 2016 ≥15.01.2507.077, SE ≥15.02.2562.056) removes the condition. The primary limiting factor is the requirement for pre-existing local authorized access.

This is a credible but context-dependent priority rather than a drop-everything emergency. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.8 High) describes a local, low-complexity privilege escalation requiring an attacker to already hold some authenticated foothold (PR:L) on the Exchange server itself - it is not a remotely-reachable pre-auth flaw. Impact is severe once triggered (full C/I/A compromise, enabling escalation to SYSTEM-level control of the mail infrastructure). Weighing the signals: no EPSS score was provided, the CVE is not listed in CISA KEV, and no public POC is referenced, so there is no public exploit identified at time of analysis - exploitation probability signals are absent or neutral. The dominant real-world consideration is that Exchange is a high-value target and a common post-compromise pivot: an attacker who has gained a limited authenticated foothold (e.g., via a prior web/service compromise) would use this to escalate. There is no conflict between CVSS and the description - both agree on local vector and authorization requirement. Net: a meaningful second-stage/escalation risk on a sensitive platform, patch promptly, but the local + authenticated prerequisites materially reduce standalone mass-exploitation risk versus a network pre-auth CVE.

An attacker who already has low-privileged authenticated access to an Exchange Server host (for example, via a compromised service account or a prior foothold) supplies crafted serialized data to a vulnerable component, triggering unsafe deserialization (CWE-502) and code execution in a higher-privilege context. No public exploit is identified at time of analysis, and the attack requires local access and existing authorization (PR:L) rather than remote unauthenticated reach.