Search CVEs, research… / diras.sa
  • PoC PUBLIC
  • PATCH AVAILABLE

CVE-2026-62911: authentication bypass in Microsoft Microsoft Exchange Server 2016 Cumulative Update 23

An authorized attacker can bypass authentication and elevate privileges in Microsoft Exchange Server, enabling remote privilege escalation across affected cumulative updates; see CVE-2026-62911. The vulnerability impacts Exchange Server 2016 Cumulative Update 23 (15.01.0.0 through before 15.01.2507.072) and several Exchange Server 2019 and Subscription Edition releases listed below. Exploitation requires network access and an authorized account interaction that can be abused via a capture-replay authentication bypass technique.

Published Updated Source: CVE Program, NVD, FIRST EPSS, Vendor advisory

CVSS 3.1
8HIGH
EPSS
0.00694
CWE
CWE-294
KEV DUE DATE
Not listed
PATCH
Available

DIRAS TAKE

Urgent: public exploit code exists, so patch quickly; a working exploit is publicly available and fixes are released for the affected Exchange builds.

What is CVE-2026-62911?

An authorized attacker can bypass authentication and elevate privileges in Microsoft Exchange Server, enabling remote privilege escalation across affected cumulative updates; see CVE-2026-62911. The vulnerability impacts Exchange Server 2016 Cumulative Update 23 (15.01.0.0 through before 15.01.2507.072) and several Exchange Server 2019 and Subscription Edition releases listed below. Exploitation requires network access and an authorized account interaction that can be abused via a capture-replay authentication bypass technique.

Vector CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H

Which versions of Microsoft Microsoft Exchange Server 2016 Cumulative Update 23 are affected?

BRANCHAFFECTEDFIXED
Microsoft Exchange Server 2016 Cumulative Update 23 15.x15.01.0.0 – before 15.01.2507.07215.01.2507.072
Microsoft Exchange Server 2019 Cumulative Update 14 15.x15.02.0.0 – before 15.02.1544.04415.02.1544.044
Microsoft Exchange Server 2019 Cumulative Update 15 15.x15.02.0.0 – before 15.02.1748.04915.02.1748.049
Microsoft Exchange Server Subscription Edition RTM 15.x15.02.0.0 – before 15.02.2562.04615.02.2562.046

Is CVE-2026-62911 being exploited?

Public exploit code is available.

How to fix CVE-2026-62911

  1. Upgrade Exchange Server 2016 CU23 to 15.01.2507.072 or later.
  2. Upgrade Exchange Server 2019 CU14 to 15.02.1544.044 or later, or CU15 to 15.02.1748.049 or later as appropriate.
  3. Upgrade Exchange Server Subscription Edition RTM to 15.02.2562.046 or later.
  4. If you cannot patch immediately, restrict network exposure of Exchange management and authentication endpoints and monitor logs for anomalous authentication activity.

Frequently asked questions

Is CVE-2026-62911 being actively exploited?

Public exploit code is available for CVE-2026-62911.

Which Microsoft Exchange Server versions are affected by CVE-2026-62911?

Affected builds include Exchange 2016 CU23 versions 15.01.0.0 through before 15.01.2507.072 and multiple Exchange 2019 and Subscription Edition builds listed in the vendor advisory.

Is there a patch for CVE-2026-62911?

Yes; Microsoft published fixes: 15.01.2507.072 for Exchange 2016 CU23 and the fixed builds 15.02.1544.044, 15.02.1748.049, and 15.02.2562.046 for the listed 2019 and Subscription Edition branches.

Does CVE-2026-62911 require authentication?

Yes; exploitation involves an authorized account and a capture-replay technique that elevates privileges over the network.

References