High · 7.8 CVE-2026-55009 EUVD-2026-44027GHSA-78c8-h6hm-94hg

Microsoft Exchange Server Elevation of Privilege Vulnerability

Published Jul 14, 2026 · Updated Nov 10, 2026 · Assigned by microsoft

Vendor: Microsoft Product: Microsoft Exchange Server 2016 Cumulative Update 23 Product: Microsoft Exchange Server 2019 Cumulative Update 14 Product: Microsoft Exchange Server 2019 Cumulative Update 15 Product: Microsoft Exchange Server Subscription Edition RTM

Description

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Affected products

Vendor	Product	Affected	Fixed
Microsoft	Microsoft Exchange Server 2016 Cumulative Update 23	15.01.0.0 – < 15.01.2507.071	15.01.2507.071
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 14	15.02.0.0 – < 15.02.1544.043	15.02.1544.043
Microsoft	Microsoft Exchange Server 2019 Cumulative Update 15	15.02.0.0 – < 15.02.1748.048	15.02.1748.048
Microsoft	Microsoft Exchange Server Subscription Edition RTM	15.02.0.0 – < 15.02.2562.045	15.02.2562.045

Advisories 4

WID-SEC-2026-2316 Microsoft Windows Produkte: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 6, 2026
WID-SEC-2026-2326 Microsoft Exchange: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 14, 2026
NCSC-2026-0234 Kwetsbaarheden verholpen in Microsoft Exchange NCSC-NL (Netherlands) · Jul 14, 2026
MSRC-CVE-2026-55009 Microsoft Exchange Server Elevation of Privilege Vulnerability Microsoft Security Response Center · Jul 14, 2026

References

Microsoft Exchange Server Elevation of Privilege Vulnerability vendor-advisory patch