Microsoft Exchange Server CVE-2026-87696

Exploitation requires an already-authenticated low-privilege identity on the Exchange Server (PR:L) and the ability to present a token whose signature defeats the server's flawed cryptographic verification - i.e., forging or tampering with a JWT/security token that Exchange improperly validates (CWE-347). It is not remote-unauthenticated: a valid foothold account is mandatory. The High attack complexity (AC:H) further limits exploitation, requiring conditions outside the attacker's control (such as specific token, key, or signature-state circumstances) rather than a reliable one-shot request. No user interaction is needed (UI:N). Affected builds are Exchange 2016 CU23 (<15.01.2507.077), Exchange 2019 CU14 (<15.02.1544.050) and CU15 (<15.02.1748.055), and Exchange Subscription Edition RTM (<15.02.2562.056); patched builds are not exploitable.

This is an authenticated network elevation-of-privilege flaw (CWE-347, improper cryptographic signature verification) in Microsoft Exchange Server carrying a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H). The signals are internally consistent and point to a serious-but-not-emergency issue: the CVSS vector shows network reachability with full confidentiality, integrity, and availability impact, but exploitation requires low-level privileges (PR:L) and has high attack complexity (AC:H), meaning conditions outside the attacker's control (e.g., timing, specific token state, or crafting a valid-looking signature) must be met. CISA SSVC reinforces this: Exploitation is rated 'none' (no observed activity), Automatable is 'no' (not mass-scannable/wormable), while Technical Impact is 'total' - so the damage ceiling is high but opportunistic mass exploitation is unlikely. There is no CISA KEV listing and no public exploit identified at time of analysis; EPSS was not provided in the input. Net: a real priority for internet-facing Exchange where any low-privilege foothold exists (the 'total' technical impact and network vector justify prompt patching), but the AC:H, PR:L, SSVC 'automatable:no' and absence of known exploitation argue against treating it as a drop-everything zero-day. Note a minor tagging tension: the 'Information Disclosure' tag conflicts with the description, which characterizes this as privilege elevation - verify the impact framing with the vendor advisory.

An attacker who already holds a low-privilege authenticated identity on an Exchange deployment forges or manipulates a token so that its cryptographic signature passes Exchange's flawed verification (consistent with the 'Jwt Attack' tag), causing the server to accept an attacker-controlled claim and grant elevated privileges over the network. Because attack complexity is High (AC:H), success depends on satisfying conditions the attacker does not fully control, such as token/key state or timing. No public exploit code has been identified at time of analysis.