EUVD-2026-91771
GHSA-q9jh-jffv-9xvh
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Network-reachable weak-authorization flaw exploitable by any low-privilege authenticated user (PR:L) without interaction, yielding full privilege elevation and high C/I/A impact.
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
AnalysisAI
Privilege escalation in on-premises Microsoft Exchange Server allows an authenticated attacker with a standard mailbox or domain user account (PR:L) to gain high confidentiality, integrity, and availability impact over the network. The vulnerability affects Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
No credit card · 7-day full trial
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to already possess valid authenticated access to the Exchange environment (CVSS PR:L - e.g., a standard mailbox or domain user account) and network reachability to the Exchange Server over its service endpoints. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | This is a genuine priority for organizations running on-premises Microsoft Exchange Server. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released patch from the Microsoft Security Response Center (MSRC) advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940; the exact KB number is not specified in the available input, so consult the advisory for the correct update for each affected build (Exchange 2016 CU23, Exchange 2019 CU14/CU15, and Subscription Edition RTM). … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, inventory every on-premises Exchange Server instance and identify which run Exchange Server 2016 CU23, Exchange Server 2019 CU14, Exchange Server 2019 CU15, or Exchange Server Subscription Edition RTM, then determine which of those builds already have the vendor's security update applied and flag the remainder for immediate remediation scheduling. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
Cross-site scripting (XSS) in Microsoft Exchange Server enables remote attackers to spoof content and steal credentials
Stored/reflected cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition
Remote code execution in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets an aut
Local privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) allows
Local privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) allows
Same weakness CWE-1390 – Weak Authentication
View allShare
External POC / Exploit Code
Leaving vuln.today