TI-2026-72855 Aliases CVE-2026-87696 GHSA-q352-99mq-9jqq

Microsoft Exchange Server flaw lets attackers gain higher privileges

LOW 35CWE-347Published 2026-10-13 · Updated 2026-10-31

Key facts

Attack vector: Network
Privileges required: Low
User interaction: None
Attack complexity: High
Impact type: Security bypass
Confidentiality · integrity · availability: High · High · High
Fix status: Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA. Impact type from CWE-347.

Summary

Microsoft Exchange Server 2016 Cumulative Update 23 from 15.01.0.0 before 15.01.2507.077, 2019 Cumulative Update 14 from 15.02.0.0 before 15.02.1544.050, 2019 Cumulative Update 15 from 15.02.0.0 before 15.02.1748.055, and Subscription Edition RTM from 15.02.0.0 before 15.02.2562.056 are affected. Improper verification of a cryptographic signature (CWE-347) lets an authorized remote attacker with low privileges gain higher privileges, without user interaction.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.0042 36th percentileScored 2026-11-07

Fix Fixed Microsoft Exchange Server 2016 Cumulative Update 23 (Microsoft): 15.01.2507.077Microsoft Exchange Server 2019 Cumulative Update 14 (Microsoft): 15.02.1544.050+2 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: No
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	15.01.0.0 to before 15.01.2507.077	15.01.2507.077	Patch available	CNA
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 14	15.02.0.0 to before 15.02.1544.050	15.02.1544.050	Patch available	CNA
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 15	15.02.0.0 to before 15.02.1748.055	15.02.1748.055	Patch available	CNA
Microsoft	Microsoft Exchange Server Subscription Edition RTM	15.02.0.0 to before 15.02.2562.056	15.02.2562.056	Patch available	CNA

Microsoft Exchange Server 2016 Cumulative Update 23 VendorMicrosoft Affected 15.01.0.0 to before 15.01.2507.077 Fixed in 15.01.2507.077 Patch available CNA
Microsoft Exchange Server 2019 Cumulative Update 14 VendorMicrosoft Affected 15.02.0.0 to before 15.02.1544.050 Fixed in 15.02.1544.050 Patch available CNA
Microsoft Exchange Server 2019 Cumulative Update 15 VendorMicrosoft Affected 15.02.0.0 to before 15.02.1748.055 Fixed in 15.02.1748.055 Patch available CNA
Microsoft Exchange Server Subscription Edition RTM VendorMicrosoft Affected 15.02.0.0 to before 15.02.2562.056 Fixed in 15.02.2562.056 Patch available CNA

CPE configurations NVD · 4

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23::::::	2016 cumulative_update_23	Vulnerable	Microsoft
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14::::::	2019 cumulative_update_14	Vulnerable	Microsoft
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15::::::	2019 cumulative_update_15	Vulnerable	Microsoft
cpe:2.3:a:microsoft:exchange_server_subscription_edition::::::::	before 15.02.2562.056	Vulnerable	Microsoft

cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:* Versions 2016 cumulative_update_23 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:* Versions 2019 cumulative_update_14 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15:*:*:*:*:*:* Versions 2019 cumulative_update_15 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:* Versions before 15.02.2562.056 Vulnerable ·Microsoft

Remediation

Microsoft Exchange Server 2016 Cumulative Update 23 is fixed in 15.01.2507.077. Microsoft Exchange Server 2019 Cumulative Update 14 is fixed in 15.02.1544.050, and Cumulative Update 15 is fixed in 15.02.1748.055. Microsoft Exchange Server Subscription Edition RTM is fixed in 15.02.2562.056.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Fix · CNA Microsoft Exchange Server 2016 Cumulative Update 23 (Microsoft) Fixed in 15.01.2507.077
Fix · CNA Microsoft Exchange Server 2019 Cumulative Update 14 (Microsoft) Fixed in 15.02.1544.050
Fix · CNA Microsoft Exchange Server 2019 Cumulative Update 15 (Microsoft) Fixed in 15.02.1748.055
Fix · CNA Microsoft Exchange Server Subscription Edition RTM (Microsoft) Fixed in 15.02.2562.056

Timeline

2026-10-13 Threatist record created from CVE-2026-87696
2026-10-13 Alias added: GHSA-q352-99mq-9jqq
2026-10-14 CISA SSVC decision points changed

References

Patch 1

Microsoft Exchange Server Elevation of Privilege Vulnerability

TI-2024-14170 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2022-19610 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2021-13547 Microsoft Exchange Server Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2021-13502 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2021-08465 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-07929 Microsoft Exchange Server Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8

See all 258 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences