Microsoft Exchange Server EUVD-2026-100139

The description specifies only a network-reachable stack-based buffer overflow with no stated configuration precondition, consistent with AV:N/PR:N/UI:N - i.e., remote unauthenticated exploitation against an Exchange Server reachable over the network. The key limiting factor is AC:H: successful exploitation depends on conditions outside the attacker's direct control (e.g., defeating stack protections, memory layout/timing, or reaching a specific vulnerable code path), which makes reliable exploitation non-trivial and non-automatable (SSVC Automatable=no). Exposure is further bounded to unpatched builds below the fixed versions: Exchange Server Subscription Edition RTM <15.02.2562.056, 2019 CU15 <15.02.1748.055, 2019 CU14 <15.02.1544.050, and 2016 CU23 <15.01.2507.077. Internet-facing Exchange deployments are at materially higher risk than internally segmented ones.

Signals are mixed and point to a serious-but-not-imminent threat. The CVSS 3.1 vector (AV:N/AC:H/PR:N/UI:N) confirms a remote, unauthenticated, no-user-interaction path with total CIA impact (C:H/I:H/A:H), which is why the base score reaches 8.1 (High). The limiting factor is AC:H - attack complexity is high, meaning exploitation is not trivially repeatable and likely depends on conditions or mitigation bypasses an attacker cannot fully control. CISA's SSVC framework corroborates a lower operational urgency: Exploitation=none (no observed exploitation) and Automatable=no (cannot be reliably mass-scanned/weaponized), even though Technical Impact=total aligns with the full RCE claim. No KEV listing and no POC are present in the data, so there is no public exploit identified at time of analysis. Net assessment: this is a genuinely high-impact pre-auth RCE in a high-value target (Exchange), so it should be prioritized for patching, but the AC:H rating plus SSVC 'none/no' indicate it is not currently a mass-exploited, automatable threat - treat it as high-priority patch management rather than an active-incident emergency. EPSS score was not provided in the input and therefore cannot be factored in; absence of EPSS is a data gap, not a signal of low risk.

A remote, unauthenticated attacker sends specially crafted network traffic to an internet-exposed Microsoft Exchange Server, triggering a stack-based buffer overflow (CWE-121) in a network-facing component and achieving arbitrary code execution in the Exchange process context. Because the CVSS vector is AV:N/PR:N/UI:N, no credentials or user interaction are needed, but AC:H means the attacker must satisfy non-trivial conditions or bypass memory protections for reliable exploitation. No public exploit identified at time of analysis, so any current attempt would require original exploit development.