Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Fix
Microsoft's update · Important
- KB5128898 — Microsoft Exchange Server 2016 Cumulative Update 23 · build 15.01.2507.077
- KB5128897 — Microsoft Exchange Server 2019 Cumulative Update 14 · build 15.02.1544.050
- KB5128895 — Microsoft Exchange Server Subscription Edition RTM · build 15.02.2562.056
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28 · Exploitation Less Likely.
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 2
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-19 19:39
- First seenCVSS 7.8NVD modified 2026-10-13 21:19
Affected (CPE criteria) 0
NVD has not attached CPE configurations yet.