Microsoft Exchange Server: Local elevation of privilege

Summary

Microsoft Exchange Server (on-premises) contains an untrusted control sphere inclusion weakness (CWE-829) that allows an authorized local attacker to elevate privileges. The CVSS 3.1 base score is 7.8 (High). Exploitation requires an existing low-privileged foothold on the Exchange server, for example a compromised account, and no user interaction. A successful attacker can gain full control of the server and its mailboxes, so the flaw mainly raises the impact of any other compromise on the host.

Affected

• Exchange Server 2016 CU23: 15.01.0.0 to before 15.01.2507.077
• Exchange Server 2019 CU14: 15.02.0.0 to before 15.02.1544.050
• Exchange Server 2019 CU15: 15.02.0.0 to before 15.02.1748.055
• Exchange Server Subscription Edition RTM: 15.02.0.0 to before 15.02.2562.056

Build ranges are taken from the CVE record and third-party trackers; verify them on the MSRC advisory.

Fixed in

• Exchange Server 2016 CU23: Fixed build 15.01.2507.077 or later; KB number unknown.
• Exchange Server 2019 CU14: KB5128897
• Exchange Server 2019 CU15: KB5128896 (build 15.02.1748.055)
• Exchange Server Subscription Edition RTM: KB5128895 (SU11); fixed build 15.02.2562.056 according to the CVE record, not independently confirmed.

All fixes were released on October 13, 2026.

Workaround

No workaround is documented for this CVE. Installing the October 2026 security update is the only documented fix.

Exploitation

• Not known to be exploited in the wild.
• Not listed in the CISA Known Exploited Vulnerabilities catalog.
• CISA SSVC rates exploitation as none and automatable as no.
• EPSS values reported by Senserva are below 1% to 1.6%; these figures are inconsistent and only approximate.
• No public proof of concept was found; this does not prove that none exists.

Our recommendation

• Install the October 13, 2026 security update on all affected Exchange servers, prioritizing internet-facing systems.
• Exchange Server 2016 and 2019 have received their final security updates and are only covered through the Extended Security Update (ESU) Period 2 program; plan migration to Exchange Server Subscription Edition.
• Verify installed build numbers and affected ranges on the MSRC advisory before rollout.
• Review local administrator accounts and strengthen admin passwords, since a low-privileged foothold is required.
• Monitor for unusual local privilege changes and new services or scheduled tasks on Exchange servers.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

PoC-in-GitHub, Metasploit and Exploit-DB list nothing for this CVE.

Research sources

• Microsoft Security Response Center advisory CVE-2026-87695 msrc.microsoft.com
• OpenCVE entry CVE-2026-87695 app.opencve.io
• Senserva KB5128895 (Subscription Edition SU11) senserva.com
• Senserva KB5128897 (Exchange 2019 CU14) senserva.com
• UGetFix KB5128896 (Exchange 2019 CU15, third-party) ugetfix.com
• Eightwone: Exchange 2016 and SE security updates October 2026 eightwone.com
• FrankysWeb: Security updates for Exchange Server October 2026 www.frankysweb.de
• Icewolf: Exchange Server SE SU11 released blog.icewolf.ch

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 2 Nov 2026, 01:36.