Microsoft Exchange Server EUVD-2026-56688

Exploitation requires the attacker to (1) hold a valid low-privilege account authorized against the targeted Exchange organization, satisfying the PR:L CVSS metric; (2) achieve a network position capable of intercepting authentication traffic between a higher-privileged user and the Exchange Server - a passive capture or active MITM posture on a shared network segment, VLAN, or via a compromised intermediate host; and (3) trigger or wait for a target user to authenticate to Exchange during the capture window, satisfying the UI:R requirement. Exploitation is limited by the need for authenticated initial access and active network traffic interception capability, ruling out fully remote, unauthenticated opportunistic attacks. Defenders with strong network segmentation, encrypted internal traffic enforcement, and multi-factor authentication have meaningful mitigation against the replay component even on unpatched systems.

The CVSS 3.1 score of 8.0 with vector AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H reflects a serious network-exploitable flaw with full CIA triad impact, but several conditions constrain real-world exploitation. The PR:L metric confirms the attacker must already hold a low-privilege account in the Exchange environment, and UI:R indicates a legitimate user must perform an authentication action during the attack window. AC:L in the official vector may understate the practical complexity of establishing capture-replay positioning - a man-in-the-middle network posture or passive traffic interception capability is implicitly required. No EPSS score was provided in the source data, and the absence of a CISA KEV listing and public POC reduces the urgency compared to a fully weaponized, unauthenticated flaw. That said, Exchange Server is a historically high-value target and privilege escalation to administrative or mailbox-level access represents a critical business risk in most enterprise environments. Organizations with unpatched on-premises Exchange deployments should treat this as a high-priority patch given the track record of Exchange vulnerabilities being rapidly weaponized once details become public.

An attacker with a low-privilege domain account and a network-level position between a targeted user and the Exchange Server - achieved via ARP spoofing, rogue access point, or compromised intermediate host - waits for the victim to authenticate to Exchange. The attacker captures the authentication token or challenge-response exchange and immediately replays it to the Exchange Server, obtaining a session context at the victim's privilege level or higher. No public POC exists at time of analysis, but the generic nature of CWE-294 replay attacks means the technique is well-understood by threat actors already operating within enterprise network segments.