Microsoft Exchange Server EUVD-2026-100140

Exploitation requires the attacker to already possess valid low-privilege authenticated access to the Exchange environment (CVSS PR:L, 'authorized attacker'); it is not exploitable by a fully unauthenticated outsider. Given that prerequisite, no user interaction and no special non-default feature is named in the description - the incorrect authorization flaw is reachable over the network against the affected builds (Exchange Server 2016 CU23 before 15.01.2507.077, 2019 CU14 before 15.02.1544.050, 2019 CU15 before 15.02.1748.055, and Subscription Edition before 15.02.2562.056). The primary limiting factor is therefore the need for a pre-existing authenticated foothold; SSVC Automatable 'no' further indicates exploitation is not reliably scriptable at scale.

This is a genuinely high-priority vulnerability that warrants prompt patching, though the signals are mixed on urgency. The CVSS 3.1 vector (AV:N/AC:L/PR:L/UI:N) confirms a network-exploitable flaw requiring only low privileges and no user interaction, with total impact on confidentiality, integrity and availability (C:H/I:H/A:H), consistent with the vendor-reported 8.8 score and CWE-863 (incorrect authorization). The CISA SSVC framework corroborates the severity of outcome (Technical Impact: total) but tempers urgency: Exploitation is 'none' (no observed or public exploitation) and Automatable is 'no', meaning this is not a mass-scannable, wormable condition. No EPSS score, CISA KEV listing, or POC was provided in the input, so there is no evidence of active exploitation - no public exploit identified at time of analysis. The key caveat is that PR:L means an attacker must already hold a low-privileged, authenticated foothold on the Exchange environment, so this is a privilege-escalation primitive for an already-present adversary rather than an initial-access vector. Net assessment: a real priority for defenders of internet-facing Exchange given the product's attractiveness and total impact, but currently evidence-of-exploitation is absent, so it ranks below any actively exploited Exchange flaw.

An attacker who already holds valid low-privilege credentials on a mailbox or service account sends crafted requests to the Exchange Server over the network, abusing an incorrect authorization check (CWE-863) to perform actions reserved for higher-privileged roles. No user interaction is required, and success yields elevated privileges with full read/write and availability impact across the targeted Exchange system. No public exploit code was identified in the provided data.