TI-2026-72854 Aliases CVE-2026-87695 GHSA-5vjr-2cg4-x9qw

Microsoft Exchange Server flaw allows local privilege escalation

LOW 36CWE-829Published 2026-10-13 · Updated 2026-10-31

Key facts

Attack vector: Local
Privileges required: Low
User interaction: None
Attack complexity: Low
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-829.

Summary

Microsoft Exchange Server 2016 Cumulative Update 23 from 15.01.0.0 before 15.01.2507.077, Exchange Server 2019 Cumulative Update 14 from 15.02.0.0 before 15.02.1544.050, Exchange Server 2019 Cumulative Update 15 from 15.02.0.0 before 15.02.1748.055, and Exchange Server Subscription Edition RTM from 15.02.0.0 before 15.02.2562.056 are affected. Inclusion of functionality from an untrusted control sphere (CWE-829) lets an authorized local attacker with low privileges gain elevated privileges.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00292 21st percentileScored 2026-11-08

Fix Fixed Microsoft Exchange Server 2016 Cumulative Update 23 (Microsoft): 15.01.2507.077Microsoft Exchange Server 2019 Cumulative Update 14 (Microsoft): 15.02.1544.050+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	15.01.0.0 to before 15.01.2507.077	15.01.2507.077	Patch available	CNA
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 14	15.02.0.0 to before 15.02.1544.050	15.02.1544.050	Patch available	CNA
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 15	15.02.0.0 to before 15.02.1748.055	15.02.1748.055	Patch available	CNA
Microsoft	Microsoft Exchange Server Subscription Edition RTM	15.02.0.0 to before 15.02.2562.056	15.02.2562.056	Patch available	CNA

Microsoft Exchange Server 2016 Cumulative Update 23 VendorMicrosoft Affected 15.01.0.0 to before 15.01.2507.077 Fixed in 15.01.2507.077 Patch available CNA
Microsoft Exchange Server 2019 Cumulative Update 14 VendorMicrosoft Affected 15.02.0.0 to before 15.02.1544.050 Fixed in 15.02.1544.050 Patch available CNA
Microsoft Exchange Server 2019 Cumulative Update 15 VendorMicrosoft Affected 15.02.0.0 to before 15.02.1748.055 Fixed in 15.02.1748.055 Patch available CNA
Microsoft Exchange Server Subscription Edition RTM VendorMicrosoft Affected 15.02.0.0 to before 15.02.2562.056 Fixed in 15.02.2562.056 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23::::::	2016 cumulative_update_23	Vulnerable	Microsoft
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14::::::	2019 cumulative_update_14	Vulnerable	Microsoft
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15::::::	2019 cumulative_update_15	Vulnerable	Microsoft
cpe:2.3:a:microsoft:exchange_server_subscription_edition::::::::	before 15.02.2562.056	Vulnerable	Microsoft

cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:* Versions 2016 cumulative_update_23 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:* Versions 2019 cumulative_update_14 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15:*:*:*:*:*:* Versions 2019 cumulative_update_15 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:* Versions before 15.02.2562.056 Vulnerable ·Microsoft

Remediation

Update Microsoft Exchange Server 2016 Cumulative Update 23 to version 15.01.2507.077, Exchange Server 2019 Cumulative Update 14 to version 15.02.1544.050, Exchange Server 2019 Cumulative Update 15 to version 15.02.1748.055, and Exchange Server Subscription Edition RTM to version 15.02.2562.056.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Microsoft Exchange Server 2016 Cumulative Update 23 (Microsoft) Fixed in 15.01.2507.077
Fix · CNA Microsoft Exchange Server 2019 Cumulative Update 14 (Microsoft) Fixed in 15.02.1544.050
Fix · CNA Microsoft Exchange Server 2019 Cumulative Update 15 (Microsoft) Fixed in 15.02.1748.055
Fix · CNA Microsoft Exchange Server Subscription Edition RTM (Microsoft) Fixed in 15.02.2562.056

Timeline

2026-10-13 Threatist record created from CVE-2026-87695
2026-10-13 Alias added: GHSA-5vjr-2cg4-x9qw
2026-10-14 CISA SSVC decision points changed

References

Patch 1

Microsoft Exchange Server Elevation of Privilege Vulnerability

TI-2024-14170 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2022-19610 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2021-13547 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2021-13502 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2021-08465 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-07929 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8

See all 258 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences