Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Fix
Microsoft's update · Important
- KB5128895 — Microsoft Exchange Server Subscription Edition RTM · build 15.02.2562.056
- KB5128896 — Microsoft Exchange Server 2019 Cumulative Update 15 · build 15.02.1748.055
- KB5128897 — Microsoft Exchange Server 2019 Cumulative Update 14 · build 15.02.1544.050
- KB5128898 — Microsoft Exchange Server 2016 Cumulative Update 23 · build 15.01.2507.077
From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28 · Exploitation Less Likely.
Patch, vendor advisory and mitigation references on NVD 1
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87695 Patch, Vendor Advisory
Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.
Change history 4
- Cpes+4 CPE criteria (now 4)NVD modified 2026-10-27 17:02
- StatusPublished → AnalyzedNVD modified 2026-10-27 17:02
- StatusUndergoing Analysis → PublishedNVD modified 2026-10-19 19:39
- First seenCVSS 7.8NVD modified 2026-10-14 04:18
Affected (CPE criteria) 4
cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15:*:*:*:*:*:*cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:*
References 1
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-87695 Patch, Vendor Advisory