Microsoft Exchange Server EUVD-2026-73146

Exploitation requires the attacker to already be an authenticated, privileged principal on the target Exchange environment (CVSS PR:H = 'authorized attacker'), reachable over the network (AV:N) with no user interaction (UI:N) and low complexity (AC:L). The limiting factor is that pre-existing privileged access is mandatory - this is not a pre-auth/unauthenticated flaw - so realistic risk is confined to malicious insiders or post-compromise privilege escalation on on-premises Exchange 2016 CU23, 2019 CU14/CU15, or Subscription Edition builds below the fixed versions. Cloud-only Exchange Online is not indicated in the affected-versions data.

The CVSS 3.1 vector (AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H = 9.1 Critical) describes a low-complexity, network-reachable elevation of privilege that requires the attacker to already hold privileges (PR:H) but no user interaction, with a scope change and full confidentiality/integrity/availability impact. There is no EPSS value, no CISA KEV listing, and no POC signal in the provided data, so exploitation should currently be treated as no public exploit identified - the high score reflects potential impact, not confirmed weaponization. The PR:H requirement is a meaningful limiter: an attacker needs an existing privileged foothold, which narrows realistic exploitation to insiders or post-compromise scenarios rather than pure drive-by attacks. That said, Exchange is a historically heavily targeted product and a scope-changing EoP is exactly the kind of primitive attackers chain after initial access, so this warrants prompt patching despite the lack of active-exploitation signals.

An attacker who has already obtained a privileged Exchange account (for example via prior credential theft or an insider) sends a crafted network request to an unpatched Exchange server that fails to authorize the operation, escalating to a higher effective privilege across the messaging environment and gaining full read/modify/disrupt control over mailboxes and services. No user interaction is required and attack complexity is low. No public proof-of-concept is identified at time of analysis.