CVE-2026-62911 – Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE-2026-62911 is a Critical elevation-of-privilege vulnerability in Microsoft Exchange Server caused by an authentication bypass through capture-replay. An authorized attacker with low privileges can exploit the vulnerability over a network, with user interaction required, to elevate privileges and take over Exchange users’ mailboxes. The vulnerability is not publicly disclosed and is not known to be exploited.

CVSS Score: 8.

SEVERITY: Critical.

THREAT:
A successful attacker could take over the mailboxes of all Exchange users. This could allow the attacker to read emails, download attachments, and send emails from compromised mailboxes, putting sensitive communications and trusted identities at risk.

EXPLOITS:
No exploitation is reported, and the vulnerability is not publicly disclosed. Exploit code maturity is classified as Unproven. The source does not confirm the existence of public exploit code, zero-day exploitation, or proof-of-concept exploit code.

TECHNICAL SUMMARY:
The vulnerability is an authentication bypass caused by a capture-replay weakness (CWE-294) in Microsoft Exchange Server. An authorized attacker with low privileges can exploit it over a network to elevate privileges. Attack complexity is Low, privileges required are Low, and user interaction is Required. Successful exploitation could provide access to all Exchange users’ mailboxes, enabling the attacker to send and read emails and download attachments. The CVSS metrics rate confidentiality, integrity, and availability impacts as High.

EXPLOITABILITY:
Affected versions are Microsoft Exchange Server 2016 CU23, Exchange Server 2019 CU14, Exchange Server 2019 CU15, and Exchange Server Subscription Edition RTM. Exploitation can occur over the network with low privileges and low attack complexity, but requires user interaction.

BUSINESS IMPACT:
Compromise could expose sensitive corporate email and attachments while allowing attackers to send messages through trusted Exchange mailboxes. This creates serious risks to confidentiality, integrity, business communications, and organizational trust, with the potential for broad mailbox compromise.

WORKAROUND:
No mitigations or workarounds are identified. An official fix is specified, and customer action is required.

URGENCY:
This vulnerability is rated Critical and can result in takeover of all Exchange users’ mailboxes. Although exploitation is assessed as less likely and no exploitation is reported, the combination of network accessibility, low attack complexity, and high confidentiality, integrity, and availability impact makes prompt deployment of the official fix important.