Microsoft Exchange Server: Remote Code Execution via improper input validation
Summary
Improper input validation in Microsoft Exchange Server allows an authenticated attacker to execute code over the network. The CVSS vector requires low privileges and no user interaction, so any valid account on the server may be enough. Microsoft lists only Exchange Server Subscription Edition RTM as affected, and the CVE is not yet analysed by NVD.
Affected
- Microsoft Exchange Server Subscription Edition RTM (x64): 15.02.0.0 before 15.02.2562.057
- Exchange 2019 and Exchange 2016: Unknown. Check the MSRC product list.
Fixed in
- Subscription Edition RTM: build 15.02.2562.057 or later (implied by the affected range)
- Security update name: Unknown. A third-party tracker lists KB5133453, which is unverified.
Workaround
Unknown. No mitigation is documented in the available sources. Apply the security update.
Exploitation
- Microsoft marks the CVE as not exploited.
- Microsoft's exploitability rating is "Exploitation More Likely" (Tenable).
- Not listed in CISA KEV according to a third-party record (Strix).
- No public proof of concept found, which does not prove none exists.
- Not related to the actively exploited Outlook zero-day CVE-2026-124194 from the same Patch Tuesday.
Our recommendation
- Confirm your Exchange build against 15.02.2562.057 and apply the November 2026 security update.
- Prioritise internet-facing Exchange servers.
- Review accounts with access to the server and enforce MFA where possible.
- Check MSRC for the status of older Exchange versions instead of assuming you are unaffected.
- Monitor for a public proof of concept or KEV listing, as NVD analysis is still pending.
Information from Microsoft (Patch Tuesday November 2026)
- Severity (Microsoft)
- Critical
- Impact
- Remote code execution – Microsoft Exchange Server
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation more likely
- Product family
- Server software (Exchange, SharePoint …)
- Updates (KB)
- KB5133453
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- CVE Record CVE-2026-118207 www.cve.org
- MSRC Security Update Guide msrc.microsoft.com
- Tenable: Microsoft November 2026 Patch Tuesday www.tenable.com
- Strix CVE record CVE-2026-118207 www.strix.ai
- Shadowserver vulnerable Exchange server report www.shadowserver.org
- BleepingComputer: November 2026 Patch Tuesday www.bleepingcomputer.com
- Trinetriops: November 2026 Patch Tuesday (unverified KB mapping) trinetriops.com
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 10 Nov 2026, 22:26.
Original description (NVD)
Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.