Microsoft Exchange Server: Elevation of privilege via incorrect authorization
Summary
An authorized low-privilege user of on-premises Microsoft Exchange Server can elevate privileges over the network due to incorrect authorization (CWE-863). According to unverified secondary reporting, the attacker can manipulate a shared Exchange Control Panel cache and install a malicious mail add-in into another user's mailbox. The attack requires a valid account but no user interaction; CVSS is 8.8 (High).
Affected
- Exchange Server 2016 CU23: 15.01.0.0 to before 15.01.2507.077
- Exchange Server 2019 CU14: 15.02.0.0 to before 15.02.1544.050
- Exchange Server 2019 CU15: 15.02.0.0 to before 15.02.1748.055
- Exchange Server Subscription Edition RTM: 15.02.0.0 to before 15.02.2562.056
Fixed in
- Exchange Server Subscription Edition SU11 (KB5128895)
- Exchange Server 2019 CU14 (KB5128897)
- Exchange Server 2019 CU15 (KB5128896)
- Exchange Server 2016 CU23 (KB5128898)
- Build numbers listed by a third party should be verified on the KB pages before relying on them.
Workaround
Unknown.
Exploitation
- Not known to be exploited at the time of writing.
- CISA SSVC: Exploitation none, Automatable no, Technical Impact total.
- Not listed in CISA KEV. No public proof of concept found.
Our recommendation
- Apply the October 2026 security update promptly; for Exchange 2016 and 2019, apply the Extended Security Updates (ESU) where applicable.
- Test first, as a known issue with OWA sign-in or sending email after the update has been reported.
- Check whether OWA and ECP are reachable from the internet and restrict access if not needed.
- Enforce multi-factor authentication and review accounts for unusual mailbox or add-in changes.
- Plan migration off Exchange 2016 and 2019, as no further security updates are planned beyond ESU.
- Exchange Online customers need no action.
Information from Microsoft (Patch Tuesday October 2026)
- Severity (Microsoft)
- Important
- Impact
- Elevation of privilege – Microsoft Exchange Server
- Status on Patch Tuesday
- Neither exploited nor publicly disclosed
- Exploitability assessment
- Exploitation less likely
- Product family
- Windows ESU (Extended Security Updates), Server software (Exchange, SharePoint …)
- Updates (KB)
- KB5128895, KB5128896, KB5128897, KB5128898
Public exploits
PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.
Research sources
- Microsoft Security Update Guide: CVE-2026-77910 msrc.microsoft.com
- Senserva KB5128895 (Subscription Edition SU11) senserva.com
- Senserva KB5128898 (Exchange 2016 CU23) senserva.com
- eightwone: Security updates Exchange October 2026 eightwone.com
- Messageware: Exchange Server security updates October 2026 www.messageware.com
- Franky's Web: Security updates for Exchange Server October 2026 www.frankysweb.de
- OpenCVE: CVE-2026-77910 app.opencve.io
Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 31 Oct 2026, 18:40.
Original description (NVD)
Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
NVD references (1)
Sources
The tracker combines official, freely usable data sources – updated continuously:
- NVD (NIST) – CVEs, rating (CVSS), affected products
- CISA KEV – vulnerabilities confirmed by CISA as actively exploited
- CISA Vulnrichment – CISA assessment (SSVC) in the official CVE record
- FIRST EPSS – probability of exploitation
- Microsoft MSRC – Patch Tuesday: vulnerabilities, severity, updates
- PoC-in-GitHub – public proof-of-concept repositories
- Metasploit (Rapid7) – modules of the Metasploit Framework
- Exploit-DB (OffSec) – archive of public exploits (links only)
- Patch days: official vendor pages (linked per vendor) (Vendor patch days)
This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.
Affected? We can help.
We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.