EUVD-2026-73130
GHSA-39fx-jcrv-m48p
Severity by source
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Network-accessible weak cipher exploitable only via on-path positioning (AC:H); no auth needed; impact is passive interception only (C:H, I:N, A:N).
Primary rating from Vendor (microsoft).
CVSS VectorVendor: microsoft
Lifecycle Timeline
3DescriptionCVE.org
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
AnalysisAI
Broken or risky cryptographic algorithm usage (CWE-327) in Microsoft Exchange Server 2016 and 2019 enables unauthenticated remote attackers to intercept and disclose sensitive communications over the network. Affected builds span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the Subscription Edition, all prior to their respective patched cumulative update versions. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Exploitation requires the attacker to achieve a network-adjacent or on-path (man-in-the-middle) position between the Exchange Server and a communicating endpoint - reflected in the AC:H metric. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The CVSS 3.1 base score of 5.9 (Medium) is shaped primarily by the high attack complexity (AC:H), which significantly constrains real-world exploitability - successful exploitation requires the attacker to achieve a favorable network position such as a man-in-the-middle posture, making opportunistic mass exploitation unlikely. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | Full exploit scenario with step-by-step reproduction available after sign-in. |
| Remediation | Apply the vendor-released cumulative updates immediately: Exchange Server 2016 CU23 should be updated to version 15.01.2507.073 or later; Exchange Server 2019 CU14 to 15.02.1544.046 or later; Exchange Server 2019 CU15 to 15.02.1748.051 or later; and Exchange Server Subscription Edition to 15.02.2562.049 or later. … Detailed patch versions, workarounds, and compensating controls in full report. |
Threat intelligence, references, and detailed analysis are available after sign-in.
Same technique Information Disclosure
View allShare
External POC / Exploit Code
Leaving vuln.today