CVE-2026-69355 – Microsoft Exchange Server 2016 Cumulative Update 23
“Five flaws, one mail server, and four of them hand attackers more power than they should ever have.”
This update fixes five vulnerabilities in Microsoft Exchange Server 2016 Cumulative Update 23. Two are Critical: CVE-2026-69356 has a CVSS score of 9.3, Critical severity, and is a cross-site scripting flaw. CVE-2026-69641 has a CVSS score of 9.1, Critical severity, and is a missing authorization flaw that enables elevation of privilege. The other three are High severity, and all three enable elevation of privilege. CVE-2026-69355 has a CVSS score of 8.8, High severity, and comes from external control of a file name or path. CVE-2026-69380 has a CVSS score of 8.1, High severity, and comes from missing authorization. CVE-2026-96940 has a CVSS score of 8.8, High severity, and comes from weak authentication.
Four of the five flaws let an attacker raise their privileges on the mail server, and the Critical cross-site scripting flaw puts user sessions at risk. Exchange holds an organization's email, calendars, and identity data, so a breach here exposes the core of business communication. Apply this update to every Exchange Server 2016 CU23 system on a same-day schedule.
Key Details
- Affected Product
- Microsoft Exchange Server
- Attack Vector
- Network
- Attack Complexity
- Low
- Privileges Required
- Low
- User Interaction
- None
- CWE Classification
- CWE-73