CVE-2026-77910: Microsoft Exchange Server Elevation of Privilege Vulnerability

Overview

Severity
High (CVSS 8.8)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Elevation of Privilege
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2026-Oct
Released
2026-10-13

Description

Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

FAQ

How could an attacker exploit this vulnerability? An authenticated attacker with low privileges could poison a shared cache used by the Exchange Control Panel, causing a malicious mail add-in to be installed in the context of another user's mailbox. Successful exploitation could allow the attacker to gain elevated privileges in the affected mailbox context. User interaction is not required.

Affected Products (4)

Server Software

  • Microsoft Exchange Server Subscription Edition RTM

ESU

  • Microsoft Exchange Server 2019 Cumulative Update 15
  • Microsoft Exchange Server 2019 Cumulative Update 14
  • Microsoft Exchange Server 2016 Cumulative Update 23

Security Updates (1)

Acknowledgments

odgrso with <a href="https://gmo-cybersecurity.com/">GMO CyberSecurity by Ierae</a>, <a href="https://www.linkedin.com/in/stanley-t-62325394/">Stanley Tobias</a>

Revision History

  • 2026-10-13: Information published.