Microsoft has released security updates that address six vulnerabilities in Exchange Server. These vulnerabilities include flaws that could allow remote code execution (RCE), privilege escalation, denial-of-service (DoS), spoofing, and bypass of security features.
The vulnerabilities were disclosed on August 11, 2026, with CVE-2026-62913 receiving an update the following day.
Microsoft Exchange Server Vulnerabilities
The most severe vulnerability is CVE-2026-62913, a remote code execution flaw in Exchange Server, which has a CVSS 3.1 score of 8.8. This issue is caused by a heap-based buffer overflow, classified as CWE-122.
An authenticated attacker with low privileges could exploit this vulnerability over the network without user interaction, potentially compromising the confidentiality, integrity, and availability of the affected Exchange Server.
Another significant issue is CVE-2026-62911, an elevation-of-privilege vulnerability rated as Critical by Microsoft. This flaw carries a CVSS score of 8.0 and is linked to CWE-294, which pertains to Authentication Bypass by Capture-Replay.
Successful exploitation requires low privileges and user interaction. If abused, the vulnerability could allow an attacker to escalate privileges and gain broader control over Exchange resources or associated environments.
Organizations should prioritize updating their Exchange Server, particularly because several vulnerabilities affect core security and could be exploited in targeted attacks.
The Exchange infrastructure remains a high-value target due to its access to enterprise emails, identity workflows, internal communications, and sensitive attachments.
Affected CVEs:
- CVE-2026-62910: Elevation of Privilege – An Important-rated resource-injection issue caused by improper control of resource identifiers (CWE-99), with a CVSS score of 7.2. Exploitation requires high privileges and may compromise confidentiality, integrity, and availability.
- CVE-2026-62911: Elevation of Privilege – A Critical authentication bypass vulnerability (CWE-294), scoring 8.0. A low-privileged attacker may exploit this over the network, but user interaction is required.
- CVE-2026-62912: Denial of Service – An Important deserialization of untrusted data flaw (CWE-502) with a CVSS score of 6.5. A low-privileged attacker could cause service disruption without user interaction.
- CVE-2026-62913: Remote Code Execution – A crucial heap-based buffer overflow vulnerability (CWE-122) with a CVSS score of 8.8. It may allow low-privileged attackers to execute code remotely without requiring user interaction.
- CVE-2026-62914: Spoofing – An Important cross-site scripting vulnerability (CWE-79) with a CVSS score of 7.3. Exploitation requires low privileges and user interaction and could affect confidentiality and integrity.
- CVE-2026-62915: Security Feature Bypass – An Important missing authorization flaw (CWE-862) with a CVSS score of 6.5. A low-privilege attacker could bypass an authorization control without user interaction, potentially compromising data integrity.
Administrators should promptly review Microsoft’s security guidance for Exchange Server from August 2026, deploy the applicable updates through established change management processes, and verify successful installation across all Exchange roles.
Security teams should also monitor Exchange logs for any unusual authenticated activity, unexpected privilege changes, suspicious replay-like authentication behavior, service crashes, and unusual access to mailboxes or administrative endpoints.
Stop new phishing & malware before they compromise your business. Integrate live intel from 15K SOCs around the world
