Summary
Impact: Elevation of Privilege. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What privileges could be gained by an attacker who successfully exploited the vulnerability?
The attacker would be able to take over the mailboxes of all Exchange users, attackers can send emails, read emails, download attachments.
How could an attacker exploit this vulnerability?
An attacker authenticated to an affected Exchange server as a member of a highly privileged role group could send a specially crafted request over the network to bypass mailbox authorization checks. Successful exploitation could allow the attacker to access or modify another user's mailbox content without user interaction.
Security updates
15.01.2507.073 — https://support.microsoft.com/help/5121611
15.02.1748.051 — https://support.microsoft.com/help/5121609
15.02.1544.046 — https://support.microsoft.com/help/5121610
15.02.2562.049 — https://support.microsoft.com/help/5121608
Vulnerabilities 1
-
Critical 9.1
Microsoft Exchange Server Elevation of Privilege Vulnerability
Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Revision history
-
#1
Information published.
References
-
CVE-2026-69641 Microsoft Exchange Server Elevation of Privilege Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69641
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss