IT SBIT Services
Schneeberger
DEEN
CVE tracker

Microsoft Exchange Server: Elevation of privilege via deserialization

CVE-2026-87692High 7.8

← All vulnerabilities

Summary

Deserialization of untrusted data in on-premises Microsoft Exchange Server allows an attacker with a local, low-privileged account on the server to elevate privileges. The CVSS base score is 7.8 (High), with high impact on confidentiality, integrity and availability. This is a post-compromise escalation and is not remotely exploitable on its own, but a SYSTEM-level foothold on a mail server exposes mailboxes, credentials and the Active Directory trust.

Affected

  • Exchange Server 2016 CU23: 15.01.0.0 to before 15.01.2507.077
  • Exchange Server 2019 CU14: 15.02.0.0 to before 15.02.1544.050
  • Exchange Server Subscription Edition RTM: 15.02.0.0 to before 15.02.2562.056
  • Exchange Server 2019 CU15: unclear, sources conflict; verify in the MSRC affected products table
  • Exchange Online: not affected (on-premises CVE)

Fixed in

  • Exchange Server Subscription Edition: build 15.2.2562.56, KB5128895 (third-party data)
  • Exchange Server 2019 CU14: build 15.2.1544.50, KB5128897 (third-party data)
  • Exchange Server 2016 CU23: build 15.1.2507.77, KB5128898 (third-party data)
  • Exchange Server 2019 CU15: build 15.2.1748.55, KB5128896 (third-party data)
  • Exchange 2016 and 2019 fixes are only available with Extended Security Update Period 2 (ESU2) enrolment. These are the final security updates for 2016 and 2019.
  • Build numbers come from third-party mirrors; confirm them on the Microsoft KB pages before deployment.

Workaround

None documented. Patching is the mitigation.

Exploitation

  • In the wild: no evidence found.
  • Public proof of concept: none found.
  • CISA SSVC (ADP): Exploitation none, Automatable no, Technical Impact total.
  • EPSS: about 1.6 to 1.7 percent (third-party data).
  • CISA KEV: not verified directly; a third-party mirror lists it as not included.

Our recommendation

  • Identify all on-premises Exchange servers and their exact build numbers.
  • Install the fixed builds for Subscription Edition and supported 2019 CUs on the normal patch cycle, after checking the known OWA sign-in and mail-sending issues reported after the October Windows updates.
  • Treat Exchange 2016 and 2019 without ESU2 as unpatched: plan migration or ESU2 enrolment.
  • Restrict local logon and limit who can run commands on Exchange servers.
  • Monitor Exchange servers for unusual local processes and privilege changes.
  • Verify the affected status of 2019 CU15 and the fixed builds on the MSRC advisory and KB pages.

Information from Microsoft (Patch Tuesday October 2026)

Severity (Microsoft)
Important
Impact
Elevation of privilege – Microsoft Exchange Server
Status on Patch Tuesday
Neither exploited nor publicly disclosed
Exploitability assessment
Exploitation less likely
Product family
Windows ESU (Extended Security Updates), Server software (Exchange, SharePoint …)
Updates (KB)
KB5128898, KB5128897, KB5128895

Entry in the Microsoft Security Update Guide

Public exploits

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:41.

Original description (NVD)

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed