Summary
Impact: Information Disclosure. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What type of information could be disclosed by this vulnerability?
Exploiting this vulnerability could allow the disclosure of credentials.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation requires an attacker to first obtain a valid encrypted authentication cookie through a separate compromise and then make repeated requests to infer the protected credentials. These additional prerequisites make exploitation difficult and time-consuming.
Security updates
15.02.1748.051 — https://support.microsoft.com/help/5121609
15.02.1544.046 — https://support.microsoft.com/help/5121610
15.01.2507.073 — https://support.microsoft.com/help/5121611
15.02.2562.049 — https://support.microsoft.com/help/5121608
Vulnerabilities 1
-
Medium 5.9
Microsoft Exchange Server Information Disclosure Vulnerability
Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-69382 Microsoft Exchange Server Information Disclosure Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69382
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss