Microsoft Exchange Server CVE-2026-87695

Exploitation requires the attacker to already possess authenticated low-privileged access on the Exchange server itself (CVSS PR:L, AV:L) - this cannot be triggered remotely or by an anonymous network client, which is the single most important limiting factor. The flaw is CWE-829 (inclusion of functionality from an untrusted control sphere), meaning the attacker leverages Exchange loading or executing code/resources from a location they can influence to escalate into a higher-privileged context; no user interaction is needed (UI:N). Affected deployments are Exchange Server 2016 CU23 (<15.01.2507.077), 2019 CU14 (<15.02.1544.050) and CU15 (<15.02.1748.055), and Subscription Edition RTM (<15.02.2562.056); patched builds at or above those versions are not exploitable.

This is a credible but second-tier priority. The CVSS 3.1 vector (AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, base 7.8 HIGH) describes a local, low-complexity elevation of privilege that requires the attacker to already hold valid low-level credentials (PR:L) on the Exchange host - it is NOT a remote unauthenticated vector, which materially caps its blast radius and distinguishes it from the pre-auth RCE chains that have historically driven mass Exchange exploitation. No EPSS score, no CISA KEV listing, and no public POC were provided in the input, so exploitation status is 'no public exploit identified at time of analysis' and there is no evidence of active, widespread exploitation. The signals are internally consistent (local vector matches the 'elevate privileges locally' description), so there is no CVSS-versus-description conflict to flag. The main driver of concern is prevalence and attacker interest: Exchange is a perennially high-value, actively-targeted target, so a reliable local EoP is valuable as a post-foothold step in a chain even though it cannot be the initial access vector on its own. Net: patch on a normal-to-prompt enterprise cadence rather than emergency, prioritizing internet-facing and multi-admin Exchange hosts.

An attacker who has already gained a low-privileged authenticated foothold on an Exchange server (e.g., a compromised service or mailbox-tier account, or a limited shell from a prior bug) loads or references functionality from an untrusted control sphere (CWE-829) to run code in a higher-privileged Exchange context. No public exploit code was identified, and because the CVSS vector is local (AV:L) this is realistically a privilege-escalation link in a post-compromise chain rather than a standalone remote attack.