What is the CVSS score of EUVD-2026-56413?

EUVD-2026-56413 has a CVSS 3.1 base score of 8.8 (High). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.7%.

Which versions of Microsoft Exchange Server are affected by EUVD-2026-56413?

Microsoft Exchange Server 2016, 2019, and Subscription Edition contain a privilege escalation vulnerability (CVSS 8.8) that allows authenticated users to gain elevated system access, potentially…. A patch is available.

How to fix or mitigate EUVD-2026-56413?

Within 24 hours, inventory all Exchange deployments to identify instances running Exchange 2016 CU23 (before version 15.01.2507.072), Exchange 2019 CU14 or CU15, or Exchange Subscription Edition RTM. Within 7 days, deploy Microsoft's vendor patches to all identified affected systems. Within 30 days, validate patch deployment across the environment, review access logs for any unauthorized privilege escalation activity, and establish enhanced monitoring for privilege escalation attempts.

Microsoft Exchange Server EUVD-2026-56413

| CVE-2026-62910 HIGH

Improper Control of Resource Identifiers ('Resource Injection') (CWE-99)

2026-08-11 secure@microsoft.com

GHSA-qf6w-r299-vghv

Microsoft Code Injection Exchange Server Exchange Server Subscription Edition

8.8

CVSS 3.1 · NVD

Severity by source

Vendor (microsoft) PRIMARY

HIGH

qualitative

NVD

8.8 HIGH

AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.8 HIGH

PR:L reflects the confirmed authenticated requirement; AV:N and AC:L consistent with a network-accessible endpoint requiring no special setup; full C/I/A from privilege escalation reaching administrative access.

3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (microsoft).

CVSS VectorNVD

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Updated

Aug 14, 2026 - 15:44 vuln.today

v2 (cvss_changed)

Re-analysis Queued

Aug 14, 2026 - 15:37 vuln.today

cvss_changed

CVSS changed

Aug 14, 2026 - 15:37 NVD

7.2 (HIGH) 8.8 (HIGH)

Analysis Generated

Aug 11, 2026 - 18:57 vuln.today

Patch available

Aug 11, 2026 - 18:19 EUVD

CVE Published

Aug 11, 2026 - 17:18 nvd

HIGH 7.2

DescriptionNVD

Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

AnalysisAI

Privilege escalation in Microsoft Exchange Server 2016, 2019, and Subscription Edition allows authenticated network attackers to gain elevated privileges through resource injection (CWE-99), earning a CVSS 8.8 High rating with total technical impact across confidentiality, integrity, and availability. Affected deployment tracks span Exchange 2016 CU23 (below 15.01.2507.072), Exchange 2019 CU14 and CU15, and Exchange SE RTM, with vendor patches confirmed available for all tracks. No public exploit code has been identified at time of analysis, and SSVC assessment reports no observed exploitation, though the authenticated-only barrier is easily bypassed via credential theft and the total SSVC technical impact classification warrants prompt action.

Technical ContextAI

CWE-99 (Improper Control of Resource Identifiers) describes a vulnerability class where user-supplied input is used to construct a resource identifier - such as a file path, URL, connection string, or internal endpoint reference - without adequate validation or canonicalization, allowing an attacker to redirect server-side processing to unintended resources. Microsoft Exchange Server is Microsoft's enterprise email and collaboration platform, exposing numerous authenticated endpoints that handle server-side resource resolution as part of mail routing, calendar processing, and administrative operations. CPE data from NVD confirms Exchange Server 2016 from base RTM through CU17 as affected; EUVD data (EUVD-2026-56413) extends confirmed scope to Exchange 2016 CU23 (below 15.01.2507.072), Exchange 2019 CU14 (below 15.02.1544.044), Exchange 2019 CU15 (below 15.02.1748.049), and Exchange Server Subscription Edition RTM (below 15.02.2562.046). The network attack vector (AV:N) and low complexity (AC:L) in the CVSS vector indicate the vulnerable endpoint is broadly accessible to any authenticated Exchange user without requiring special conditions or non-default configuration.

RemediationAI

Apply vendor-released patches immediately, as Microsoft has confirmed patch availability for all affected tracks. For Exchange Server 2016 CU23, upgrade to build 15.01.2507.072 or later. For Exchange Server 2019 CU14, upgrade to 15.02.1544.044 or later; for CU19 CU15, upgrade to 15.02.1748.049 or later. For Exchange Server Subscription Edition RTM, upgrade to 15.02.2562.046 or later. Consult the MSRC advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62910 for official update packages and deployment sequencing guidance. If immediate patching is not feasible, restrict authenticated access to Exchange management and API endpoints using network segmentation or IP allowlisting - note this may impact mobile clients and third-party integrations that rely on broad endpoint access. Enforcing multi-factor authentication across all Exchange user accounts reduces the likelihood that a stolen credential alone enables exploitation, though MFA does not eliminate the vulnerability.