CVE-2026-69375: Microsoft Exchange Server Tampering Vulnerability

Overview

Severity
Medium (CVSS 6.5)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
Category
Tampering
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-Sep
Released
2026-09-08

Description

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to perform tampering over a network.

FAQ

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of integrity (I:H). What does that mean for this vulnerability? An authenticated attacker could replace valid file content with specially crafted file content. According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability? Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.

Affected Products (4)

Server Software

  • Microsoft Exchange Server Subscription Edition RTM

ESU

  • Microsoft Exchange Server 2019 Cumulative Update 15
  • Microsoft Exchange Server 2016 Cumulative Update 23
  • Microsoft Exchange Server 2019 Cumulative Update 14

Security Updates (1)

Acknowledgments

<a href="https://www.linkedin.com/in/john-nzyuko-412b563b1/">John Nzyuko</a>

Revision History

  • 2026-09-08: Information published.