Microsoft Exchange Server: Elevation of privilege via file name or path control
Summary
Microsoft Exchange Server Subscription Edition RTM versions 15.02.0.0 up to but excluding 15.02.2562.057 contain an elevation of privilege vulnerability caused by external control of a file name or path (CWE-73). An attacker who already holds high privileges on the network, for example an Exchange administrator account, can use it to gain additional privileges. No user interaction is required. Microsoft rates exploitation as less likely, and no public proof-of-concept code was found.
Affected
- Microsoft Exchange Server Subscription Edition RTM, from 15.02.0.0 before 15.02.2562.057
- Exchange Server 2016 and 2019: Unknown, not listed in the CVE record
Fixed in
- Exchange Server Subscription Edition RTM: 15.02.2562.057 or later (according to the CVE record; verify on MSRC)
- Update KB5133453 was reportedly released on 10 November 2026 (secondary source, unverified)
- Exchange Server 2016 and 2019: Unknown
Workaround
Unknown. No vendor workaround was found; patching is the recommended remedy.
Exploitation
- CISA SSVC: exploitation none, automatable no, technical impact total
- Rapid7: exploitation less likely, not publicly disclosed
- MSRC exploit code maturity: unproven (E:U)
- No public proof-of-concept or in-the-wild exploitation found; CISA KEV status not verified
Our recommendation
- Patch Exchange Server Subscription Edition RTM to at least 15.02.2562.057 in the November 2026 update cycle, starting with internet-facing servers
- Verify the KB number and fixed builds on the MSRC page before rollout
- Check whether Exchange Server 2016 or 2019 systems are in scope once MSRC confirms their status
- Limit Exchange administrative rights and monitor privileged group changes on Exchange servers
- Recheck MSRC, NVD and CISA KEV for changes in exploitation status
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Microsoft Exchange Server
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Server software (Exchange, SharePoint …)
- Updates (KB)
- KB5133453
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- MSRC Security Update Guide: CVE-2026-118151 msrc.microsoft.com
- CVE.org record: CVE-2026-118151 www.cve.org
- Rapid7 Patch Tuesday November 2026 www.rapid7.com
- Icewolf blog: Exchange Server SE SU12 (secondary, KB) blog.icewolf.ch
- Strix: CVE-2026-118151 (aggregator) www.strix.ai
- CCB Belgium: Exchange Server privilege escalation advisory (product context) ccb.belgium.be
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 11 Nov 2026, 06:47.
Original description (NVD)
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.