Microsoft Exchange Server: Elevation of privilege via untrusted inputs in security decision
Summary
A flaw in Microsoft Exchange Server Subscription Edition RTM lets an authorized attacker with a valid low-privilege account escalate privileges over the network. The vulnerability is classified as reliance on untrusted inputs in a security decision (CWE-807) and has a CVSS 3.1 base score of 8.8. Exploitation requires no user interaction, but an attacker needs prior access to a valid account, so this is mainly a post-compromise escalation risk.
Affected
- Microsoft Exchange Server Subscription Edition RTM: 15.02.0.0 to before 15.02.2562.057
- Exchange 2019 and 2016: Unknown.
Fixed in
- Exchange Server SE RTM: 15.02.2562.057 (unverified, to be confirmed by MSRC)
- Exchange 2019 and 2016: Unknown.
Workaround
Unknown.
Exploitation
- No evidence of exploitation found.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- No public proof of concept found.
- NVD status: Awaiting Analysis.
Our recommendation
- Check whether you run Exchange Server Subscription Edition RTM and whether Exchange 2019 or 2016 is affected according to the MSRC advisory.
- Apply the November 2026 Exchange Server security update as soon as possible after testing.
- Until patched, restrict and monitor accounts with access to Exchange servers.
- Monitor for unusual privilege changes and mailbox credential misuse.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Microsoft Exchange Server
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Server software (Exchange, SharePoint …)
- Updates (KB)
- KB5133453
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-118154 msrc.microsoft.com
- CVE Record CVE-2026-118154 www.cve.org
- Strix: CVE-2026-118154 www.strix.ai
- Microsoft Exchange Team Blog techcommunity.microsoft.com
- Microsoft November 2026 Patch Tuesday (CybersecurityNews) cybersecuritynews.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:18.
Original description (NVD)
Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.