CVE-2026-55007

CVE-2026-55007 is a double-free memory corruption flaw (CWE-415) in Microsoft Exchange Server in which the same heap allocation is freed twice, corrupting memory. A remote, unauthenticated attacker can trigger the flaw over the network, though the high attack complexity (AC:H) means reliable exploitation likely depends on favorable heap/timing conditions, making it harder to weaponize than typical pre-auth RCEs. Successful exploitation yields arbitrary code execution with high impact on confidentiality, integrity, and availability (CVSS 3.1: 8.1). Any organization running on-premises Microsoft Exchange Server is in scope, with the greatest risk on servers reachable from untrusted networks. As of now there is no public proof-of-concept, the flaw is not in CISA's KEV catalog, and EPSS estimates only a 0.7% chance of exploitation within 30 days; it was disclosed amid Microsoft's record September 2026 Patch Tuesday (974 CVEs), which press coverage highlighted for notable Exchange flaws.

What to do: Apply Microsoft's September 2026 Exchange Server security updates as soon as possible, prioritizing internet-facing servers (OWA/ECP and SMTP endpoints); since affected version ranges are not included in this data, confirm affected versions and fixed builds in Microsoft's advisory for CVE-2026-55007. Until patched, restrict untrusted network access to Exchange endpoints, and monitor the MSRC advisory and KEV for exploitation updates given the high-severity, pre-authentication nature of the flaw.