Exchange Server Subscription Edition
Monthly
Network-based privilege escalation in Microsoft Exchange Server lets an already-authenticated attacker gain higher privileges by exploiting a missing authorization check (CWE-862). Affected on-premises builds include Exchange 2016 CU23, Exchange 2019 CU14/CU15, and the Subscription Edition; Microsoft has released fixed cumulative-update builds via MSRC. No public exploit identified at time of analysis and the flaw is not on CISA KEV, but its 9.1 CVSS with scope change and full CIA impact makes it a high-priority patch for internet-facing mail infrastructure.
Privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) stems from missing authorization checks (CWE-862) on one or more network-accessible operations, enabling authenticated low-privileged users to gain high-impact read and write access beyond their assigned roles. All major in-support Exchange branches are affected across specific build ranges. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score reflects substantial post-exploitation impact.
Uncontrolled recursion (CWE-674) in Microsoft Exchange Server enables remote unauthenticated attackers to crash or hang the service, resulting in a complete denial of availability across all affected Exchange versions from 2016 CU23 through the current Subscription Edition. The vulnerability requires no authentication, no user interaction, and no special network position - any attacker with TCP access to the Exchange endpoint can trigger the condition. Patch is available from Microsoft; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session, enabling network-based spoofing with high confidentiality and integrity impact across a security-scope boundary. The CVSS 3.1 base score is 9.3, driven by the scope change (S:C) and the fact that no privileges are required, though the attack does require the victim to interact (UI:R) with attacker-supplied content. A vendor patch is available via MSRC; there is no public exploit identified at time of analysis.
Remote code execution in Microsoft Exchange Server allows a low-privileged authenticated network attacker to execute arbitrary code by supplying externally controlled file paths (CWE-73). Affected are Exchange Server 2016 CU23, 2019 CU14/CU15, and the Subscription Edition RTM release lines, all prior to their respective July 2026 patch levels. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft's history with Exchange RCE vulnerabilities makes this a high-priority remediation target for any organization running on-premises Exchange.
Remote code execution in Microsoft Exchange Server 2019 (CU14, CU15, and Subscription Edition) is possible via a double-free memory corruption vulnerability (CWE-415) exploitable by an unauthenticated remote attacker with no user interaction required. The CVSS vector AC:H signals that exploitation is technically complex, likely requiring precise heap-grooming to control the freed memory region and redirect execution, which constrains opportunistic mass exploitation. Microsoft has released fixes across all affected update channels; no public exploit code or CISA KEV listing has been identified at time of analysis.
SSRF in Microsoft Exchange Server enables authenticated, low-privilege network attackers to escalate privileges, with Microsoft reporting high confidentiality, integrity, and availability impact across Exchange 2016, 2019, and Subscription Edition. Vendor-released patches are available covering all affected cumulative update branches. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.62% (46th percentile) and CISA SSVC assigns Exploitation: none - meaning the CVSS 8.8 score outpaces current real-world threat activity.
Remote code execution in Microsoft Exchange Server stems from a heap-based buffer overflow (CWE-122) exploitable by any network-accessible authenticated user with low privileges. Affected versions span Exchange Server 2016 CU23, 2019 CU14 and CU15, and the Subscription Edition - all major currently-supported release lines. Vendor patches are available, and no public exploit identified at time of analysis, though the low attack complexity and full CIA impact make this a critical patching priority for enterprise Exchange deployments.
Privilege escalation via capture-replay authentication bypass in Microsoft Exchange Server 2016, 2019, and Subscription Edition exposes organizations to full mailbox and administrative compromise. An already-authorized low-privilege network user can intercept and replay authentication tokens to impersonate higher-privileged accounts, achieving high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing exists at time of analysis, but Microsoft has released patches across all affected cumulative update tracks.
Privilege escalation in Microsoft Exchange Server 2016, 2019, and Subscription Edition allows authenticated network attackers to gain elevated privileges through resource injection (CWE-99), earning a CVSS 8.8 High rating with total technical impact across confidentiality, integrity, and availability. Affected deployment tracks span Exchange 2016 CU23 (below 15.01.2507.072), Exchange 2019 CU14 and CU15, and Exchange SE RTM, with vendor patches confirmed available for all tracks. No public exploit code has been identified at time of analysis, and SSVC assessment reports no observed exploitation, though the authenticated-only barrier is easily bypassed via credential theft and the total SSVC technical impact classification warrants prompt action.
Remote code injection in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets an unauthenticated network attacker execute arbitrary code on the mail server, per CVSS 8.1 (AV:N/PR:N) and CWE-94. Microsoft (secure@microsoft.com) has released fixes, but the CVSS AC:H rating and SSVC 'Automatable: no' assessment indicate exploitation is non-trivial rather than push-button. There is no public exploit identified at time of analysis, and EPSS is low at 0.08% (23rd percentile).
Broken or risky cryptographic algorithm usage (CWE-327) in Microsoft Exchange Server 2016 and 2019 enables unauthenticated remote attackers to intercept and disclose sensitive communications over the network. Affected builds span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the Subscription Edition, all prior to their respective patched cumulative update versions. Microsoft has released corrective cumulative updates; no active exploitation or public proof-of-concept has been identified at time of analysis.
Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) exposes an authorization bypass via user-controlled key manipulation (CWE-639), allowing any authenticated network user to tamper with Exchange objects outside their authorized scope. An attacker with low-privilege access can substitute a manipulated object key in requests to affect mailbox data, calendar entries, or other resources belonging to other users, achieving high integrity impact with no confidentiality or availability consequence. Microsoft has released patched versions for all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Microsoft Exchange Server 2016, 2019, and Subscription Edition enables a network-authenticated low-privilege attacker to force the Exchange server to issue crafted outbound HTTP requests, resulting in high-confidentiality-impact information disclosure and network spoofing. The vulnerability requires only valid Exchange credentials and no user interaction, making it accessible to any mailbox user in an affected organization. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft is confirmed.
Missing authorization in Microsoft Exchange Server allows authenticated low-privilege network users to bypass a security feature, achieving high-integrity impact without requiring elevated credentials or user interaction. Rooted in CWE-862, Exchange fails to enforce a required authorization check on at least one network-accessible endpoint, enabling unauthorized high-integrity modifications - such as changes to mailbox permissions, transport rules, or security policy - by any valid account holder. No active exploitation is confirmed by CISA KEV, no public exploit code is identified, and Microsoft has released patches across all affected cumulative update tracks.
Cross-site scripting in Microsoft Exchange Server 2016 and 2019 enables authenticated low-privilege users to inject malicious scripts rendered within Exchange web interfaces, allowing spoofing of higher-privileged users over the network. Affected builds span Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available and should be applied promptly given the high confidentiality and integrity impact of successful exploitation.
Microsoft Exchange Server's handling of serialized data exposes organizations running Exchange 2016 CU23, Exchange 2019 CU14/CU15, and Exchange Subscription Edition to denial-of-service attacks from low-privileged, network-authenticated users. An authorized attacker exploiting this CWE-502 deserialization flaw can disrupt Exchange availability without requiring elevated permissions, potentially taking down email infrastructure for all dependent users and connected services. Microsoft has released cumulative update patches addressing this vulnerability; no public exploit has been identified at time of analysis.
Server-side request forgery in Microsoft Exchange Server allows an authenticated attacker with low privileges to coerce the Exchange server into making arbitrary outbound requests, resulting in disclosure of sensitive information and potential integrity impact across internal network resources. The CVSS 8.1 score reflects the high confidentiality and integrity impact from a network-reachable, low-complexity attack, though no public exploit identified at time of analysis. The vulnerability is tagged as an Authentication Bypass / SSRF, suggesting the SSRF primitive may be leveraged to bypass network-based authentication boundaries (e.g., reaching internal trusted endpoints).
Server-side request forgery in Microsoft Exchange Server enables an authenticated low-privilege attacker to coerce the server into issuing outbound network requests to internal or external resources, resulting in information disclosure. Affected deployments span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the current Subscription Edition - all at versions below their respective patched builds. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the Changed scope in the CVSS vector indicates the server can reach resources beyond its own trust boundary, amplifying reconnaissance value for an already-authenticated adversary.
Cross-site scripting and server-side request forgery in Microsoft Exchange Server enables authenticated low-privilege network attackers to perform spoofing and exfiltrate sensitive information. Affected are Exchange Server 2016 CU23, 2019 CU14, 2019 CU15, and the Subscription Edition RTM release lines, all below their respective patched cumulative update builds. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though Microsoft has released patches across all affected branches.
Cross-site scripting in Microsoft Exchange Server's web interface enables unauthenticated remote attackers to perform spoofing attacks against users of Exchange Server 2016, 2019, and Subscription Edition. The CVSS vector (PR:N/UI:R/S:C) indicates no attacker authentication is required, but a victim must interact with a crafted link, and the Changed Scope means injected scripts can cross browser security boundaries within the Exchange session. No public exploit has been identified at time of analysis, and vendor-released patches are available addressing all affected cumulative update branches.
Spoofing via UI misrepresentation in Microsoft Exchange Server 2016 and Exchange Server Subscription Edition allows unauthenticated network attackers to falsify critical sender or authentication information as rendered by the Exchange interface. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw enables an attacker to craft messages or interactions that Exchange presents deceptively, undermining trust signals recipients rely upon to distinguish legitimate from malicious communications. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the PR:N/AC:L vector means exploitation requires no credentials and minimal attacker sophistication.
Privilege escalation in Microsoft Exchange Server 2016 (and Subscription Edition per vendor tagging) allows an authenticated attacker on the network to elevate privileges through improper input validation (CWE-20). The flaw carries a CVSS 7.5 score with high impact to confidentiality, integrity, and availability, though attack complexity is rated High. No public exploit identified at time of analysis.
Privilege escalation in Microsoft Exchange Server (including 2016 cumulative updates and Subscription Edition) allows an authenticated network attacker to elevate privileges due to weak authentication mechanisms (CWE-1390). With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, this represents a significant risk to mail infrastructure, though no public exploit identified at time of analysis.
Spoofing in Microsoft Exchange Server (including 2016 cumulative updates and Subscription Edition) allows remote unauthenticated attackers to impersonate trusted entities over the network due to improper input validation. The flaw carries a CVSS 7.5 with integrity-only impact, and no public exploit identified at time of analysis. Defenders should treat it as a credible spoofing/authentication-bypass primitive that may be chained with downstream phishing or follow-on Exchange attacks.
Local privilege escalation in Microsoft Exchange Server 2016 (and Subscription Edition) stems from an incorrect implementation of an authentication algorithm (CWE-303), allowing a low-privileged local user to gain high-impact control over confidentiality, integrity, and availability of the mail platform. The flaw was reported by Microsoft (MSRC) and carries a CVSS 3.1 base of 7.8 (AV:L/AC:L/PR:L/UI:N). At time of analysis, no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but exploitation by an authenticated insider on an Exchange host would yield full server compromise.
Network-based privilege escalation in Microsoft Exchange Server lets an already-authenticated attacker gain higher privileges by exploiting a missing authorization check (CWE-862). Affected on-premises builds include Exchange 2016 CU23, Exchange 2019 CU14/CU15, and the Subscription Edition; Microsoft has released fixed cumulative-update builds via MSRC. No public exploit identified at time of analysis and the flaw is not on CISA KEV, but its 9.1 CVSS with scope change and full CIA impact makes it a high-priority patch for internet-facing mail infrastructure.
Privilege escalation in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) stems from missing authorization checks (CWE-862) on one or more network-accessible operations, enabling authenticated low-privileged users to gain high-impact read and write access beyond their assigned roles. All major in-support Exchange branches are affected across specific build ranges. Vendor-released patches are available; no public exploit code or CISA KEV listing has been identified at time of analysis, though the CVSS 8.1 score reflects substantial post-exploitation impact.
Uncontrolled recursion (CWE-674) in Microsoft Exchange Server enables remote unauthenticated attackers to crash or hang the service, resulting in a complete denial of availability across all affected Exchange versions from 2016 CU23 through the current Subscription Edition. The vulnerability requires no authentication, no user interaction, and no special network position - any attacker with TCP access to the Exchange endpoint can trigger the condition. Patch is available from Microsoft; no public exploit or CISA KEV listing has been identified at time of analysis.
Cross-site scripting in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets a remote, unauthenticated attacker inject script that executes in a victim's browser session, enabling network-based spoofing with high confidentiality and integrity impact across a security-scope boundary. The CVSS 3.1 base score is 9.3, driven by the scope change (S:C) and the fact that no privileges are required, though the attack does require the victim to interact (UI:R) with attacker-supplied content. A vendor patch is available via MSRC; there is no public exploit identified at time of analysis.
Remote code execution in Microsoft Exchange Server allows a low-privileged authenticated network attacker to execute arbitrary code by supplying externally controlled file paths (CWE-73). Affected are Exchange Server 2016 CU23, 2019 CU14/CU15, and the Subscription Edition RTM release lines, all prior to their respective July 2026 patch levels. No public exploit or active exploitation (CISA KEV) has been identified at time of analysis, though Microsoft's history with Exchange RCE vulnerabilities makes this a high-priority remediation target for any organization running on-premises Exchange.
Remote code execution in Microsoft Exchange Server 2019 (CU14, CU15, and Subscription Edition) is possible via a double-free memory corruption vulnerability (CWE-415) exploitable by an unauthenticated remote attacker with no user interaction required. The CVSS vector AC:H signals that exploitation is technically complex, likely requiring precise heap-grooming to control the freed memory region and redirect execution, which constrains opportunistic mass exploitation. Microsoft has released fixes across all affected update channels; no public exploit code or CISA KEV listing has been identified at time of analysis.
SSRF in Microsoft Exchange Server enables authenticated, low-privilege network attackers to escalate privileges, with Microsoft reporting high confidentiality, integrity, and availability impact across Exchange 2016, 2019, and Subscription Edition. Vendor-released patches are available covering all affected cumulative update branches. No public exploit code exists and no active exploitation has been confirmed - EPSS sits at 0.62% (46th percentile) and CISA SSVC assigns Exploitation: none - meaning the CVSS 8.8 score outpaces current real-world threat activity.
Remote code execution in Microsoft Exchange Server stems from a heap-based buffer overflow (CWE-122) exploitable by any network-accessible authenticated user with low privileges. Affected versions span Exchange Server 2016 CU23, 2019 CU14 and CU15, and the Subscription Edition - all major currently-supported release lines. Vendor patches are available, and no public exploit identified at time of analysis, though the low attack complexity and full CIA impact make this a critical patching priority for enterprise Exchange deployments.
Privilege escalation via capture-replay authentication bypass in Microsoft Exchange Server 2016, 2019, and Subscription Edition exposes organizations to full mailbox and administrative compromise. An already-authorized low-privilege network user can intercept and replay authentication tokens to impersonate higher-privileged accounts, achieving high confidentiality, integrity, and availability impact. No public exploit code or CISA KEV listing exists at time of analysis, but Microsoft has released patches across all affected cumulative update tracks.
Privilege escalation in Microsoft Exchange Server 2016, 2019, and Subscription Edition allows authenticated network attackers to gain elevated privileges through resource injection (CWE-99), earning a CVSS 8.8 High rating with total technical impact across confidentiality, integrity, and availability. Affected deployment tracks span Exchange 2016 CU23 (below 15.01.2507.072), Exchange 2019 CU14 and CU15, and Exchange SE RTM, with vendor patches confirmed available for all tracks. No public exploit code has been identified at time of analysis, and SSVC assessment reports no observed exploitation, though the authenticated-only barrier is easily bypassed via credential theft and the total SSVC technical impact classification warrants prompt action.
Remote code injection in Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM) lets an unauthenticated network attacker execute arbitrary code on the mail server, per CVSS 8.1 (AV:N/PR:N) and CWE-94. Microsoft (secure@microsoft.com) has released fixes, but the CVSS AC:H rating and SSVC 'Automatable: no' assessment indicate exploitation is non-trivial rather than push-button. There is no public exploit identified at time of analysis, and EPSS is low at 0.08% (23rd percentile).
Broken or risky cryptographic algorithm usage (CWE-327) in Microsoft Exchange Server 2016 and 2019 enables unauthenticated remote attackers to intercept and disclose sensitive communications over the network. Affected builds span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the Subscription Edition, all prior to their respective patched cumulative update versions. Microsoft has released corrective cumulative updates; no active exploitation or public proof-of-concept has been identified at time of analysis.
Microsoft Exchange Server (2016 CU23, 2019 CU14/CU15, and Subscription Edition) exposes an authorization bypass via user-controlled key manipulation (CWE-639), allowing any authenticated network user to tamper with Exchange objects outside their authorized scope. An attacker with low-privilege access can substitute a manipulated object key in requests to affect mailbox data, calendar entries, or other resources belonging to other users, achieving high integrity impact with no confidentiality or availability consequence. Microsoft has released patched versions for all affected branches; no public exploit code or CISA KEV listing has been identified at time of analysis.
Server-side request forgery in Microsoft Exchange Server 2016, 2019, and Subscription Edition enables a network-authenticated low-privilege attacker to force the Exchange server to issue crafted outbound HTTP requests, resulting in high-confidentiality-impact information disclosure and network spoofing. The vulnerability requires only valid Exchange credentials and no user interaction, making it accessible to any mailbox user in an affected organization. No public exploit code or CISA KEV listing has been identified at time of analysis, but patch availability from Microsoft is confirmed.
Missing authorization in Microsoft Exchange Server allows authenticated low-privilege network users to bypass a security feature, achieving high-integrity impact without requiring elevated credentials or user interaction. Rooted in CWE-862, Exchange fails to enforce a required authorization check on at least one network-accessible endpoint, enabling unauthorized high-integrity modifications - such as changes to mailbox permissions, transport rules, or security policy - by any valid account holder. No active exploitation is confirmed by CISA KEV, no public exploit code is identified, and Microsoft has released patches across all affected cumulative update tracks.
Cross-site scripting in Microsoft Exchange Server 2016 and 2019 enables authenticated low-privilege users to inject malicious scripts rendered within Exchange web interfaces, allowing spoofing of higher-privileged users over the network. Affected builds span Exchange 2016 CU23, Exchange 2019 CU14 and CU15, and Exchange Server Subscription Edition RTM. No public exploit code or active exploitation has been identified at time of analysis; a vendor patch is available and should be applied promptly given the high confidentiality and integrity impact of successful exploitation.
Microsoft Exchange Server's handling of serialized data exposes organizations running Exchange 2016 CU23, Exchange 2019 CU14/CU15, and Exchange Subscription Edition to denial-of-service attacks from low-privileged, network-authenticated users. An authorized attacker exploiting this CWE-502 deserialization flaw can disrupt Exchange availability without requiring elevated permissions, potentially taking down email infrastructure for all dependent users and connected services. Microsoft has released cumulative update patches addressing this vulnerability; no public exploit has been identified at time of analysis.
Server-side request forgery in Microsoft Exchange Server allows an authenticated attacker with low privileges to coerce the Exchange server into making arbitrary outbound requests, resulting in disclosure of sensitive information and potential integrity impact across internal network resources. The CVSS 8.1 score reflects the high confidentiality and integrity impact from a network-reachable, low-complexity attack, though no public exploit identified at time of analysis. The vulnerability is tagged as an Authentication Bypass / SSRF, suggesting the SSRF primitive may be leveraged to bypass network-based authentication boundaries (e.g., reaching internal trusted endpoints).
Server-side request forgery in Microsoft Exchange Server enables an authenticated low-privilege attacker to coerce the server into issuing outbound network requests to internal or external resources, resulting in information disclosure. Affected deployments span Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15, and the current Subscription Edition - all at versions below their respective patched builds. No public exploit code exists and the vulnerability is not listed in the CISA KEV catalog at time of analysis, but the Changed scope in the CVSS vector indicates the server can reach resources beyond its own trust boundary, amplifying reconnaissance value for an already-authenticated adversary.
Cross-site scripting and server-side request forgery in Microsoft Exchange Server enables authenticated low-privilege network attackers to perform spoofing and exfiltrate sensitive information. Affected are Exchange Server 2016 CU23, 2019 CU14, 2019 CU15, and the Subscription Edition RTM release lines, all below their respective patched cumulative update builds. No public exploit identified at time of analysis and the vulnerability is not listed in the CISA KEV catalog, though Microsoft has released patches across all affected branches.
Cross-site scripting in Microsoft Exchange Server's web interface enables unauthenticated remote attackers to perform spoofing attacks against users of Exchange Server 2016, 2019, and Subscription Edition. The CVSS vector (PR:N/UI:R/S:C) indicates no attacker authentication is required, but a victim must interact with a crafted link, and the Changed Scope means injected scripts can cross browser security boundaries within the Exchange session. No public exploit has been identified at time of analysis, and vendor-released patches are available addressing all affected cumulative update branches.
Spoofing via UI misrepresentation in Microsoft Exchange Server 2016 and Exchange Server Subscription Edition allows unauthenticated network attackers to falsify critical sender or authentication information as rendered by the Exchange interface. Rooted in CWE-451 (UI Misrepresentation of Critical Information), the flaw enables an attacker to craft messages or interactions that Exchange presents deceptively, undermining trust signals recipients rely upon to distinguish legitimate from malicious communications. No public exploit code has been identified at time of analysis, and this CVE is not listed in the CISA KEV catalog; however, the PR:N/AC:L vector means exploitation requires no credentials and minimal attacker sophistication.
Privilege escalation in Microsoft Exchange Server 2016 (and Subscription Edition per vendor tagging) allows an authenticated attacker on the network to elevate privileges through improper input validation (CWE-20). The flaw carries a CVSS 7.5 score with high impact to confidentiality, integrity, and availability, though attack complexity is rated High. No public exploit identified at time of analysis.
Privilege escalation in Microsoft Exchange Server (including 2016 cumulative updates and Subscription Edition) allows an authenticated network attacker to elevate privileges due to weak authentication mechanisms (CWE-1390). With a CVSS score of 8.8 and full confidentiality, integrity, and availability impact, this represents a significant risk to mail infrastructure, though no public exploit identified at time of analysis.
Spoofing in Microsoft Exchange Server (including 2016 cumulative updates and Subscription Edition) allows remote unauthenticated attackers to impersonate trusted entities over the network due to improper input validation. The flaw carries a CVSS 7.5 with integrity-only impact, and no public exploit identified at time of analysis. Defenders should treat it as a credible spoofing/authentication-bypass primitive that may be chained with downstream phishing or follow-on Exchange attacks.
Local privilege escalation in Microsoft Exchange Server 2016 (and Subscription Edition) stems from an incorrect implementation of an authentication algorithm (CWE-303), allowing a low-privileged local user to gain high-impact control over confidentiality, integrity, and availability of the mail platform. The flaw was reported by Microsoft (MSRC) and carries a CVSS 3.1 base of 7.8 (AV:L/AC:L/PR:L/UI:N). At time of analysis, no public exploit identified at time of analysis and the issue is not listed in CISA KEV, but exploitation by an authenticated insider on an Exchange host would yield full server compromise.