BaselineWatch
Desk

CVE-2026-87696

7.5 high SSVC exploitation: none Analyzed

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Fix

Microsoft's update · Important

  • KB5128896 — Microsoft Exchange Server 2019 Cumulative Update 15 · build 15.02.1748.055
  • KB5128895 — Microsoft Exchange Server Subscription Edition RTM · build 15.02.2562.056
  • KB5128897 — Microsoft Exchange Server 2019 Cumulative Update 14 · build 15.02.1544.050
  • KB5128898 — Microsoft Exchange Server 2016 Cumulative Update 23 · build 15.01.2507.077

From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28 · Exploitation Less Likely.

Patch, vendor advisory and mitigation references on NVD 1

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.

Change history 4

  1. Cpes+4 CPE criteria (now 4)NVD modified 2026-10-27 17:01
  2. StatusPublished → AnalyzedNVD modified 2026-10-27 17:01
  3. StatusUndergoing Analysis → PublishedNVD modified 2026-10-19 19:39
  4. First seenCVSS 7.5NVD modified 2026-10-14 04:18

Affected (CPE criteria) 4

  • cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:*

References 1