Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
How could an attacker exploit this vulnerability?
An attacker with a low-privilege user account and an assigned mailbox, could exploit weaknesses in how Exchange validates requests and identity tokens to impersonate another user. By doing so, the attacker could then access mailboxes through Exchange services as if they were that user.
What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would be able to take over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments.
Security updates
15.02.1748.051 — https://support.microsoft.com/help/5121609
15.02.1544.046 — https://support.microsoft.com/help/5121610
15.01.2507.073 — https://support.microsoft.com/help/5121611
15.02.2562.049 — https://support.microsoft.com/help/5121608
Vulnerabilities 1
-
High 8.1
Microsoft Exchange Server Elevation of Privilege Vulnerability
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-69380 Microsoft Exchange Server Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69380
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss