CVE-2026-69355

CVE-2026-69355 is a file name or path control flaw (CWE-73) in Microsoft Exchange Server in which an externally supplied file name or path is used without proper validation. An attacker who already holds a valid, low-privilege account on the affected Exchange environment can trigger the flaw remotely over the network by supplying a crafted file path, gaining arbitrary code execution on the server with high impact on confidentiality, integrity, and availability (CVSS 8.8). Because privileges are required, this is not an unauthenticated remote code execution, but any organization running a vulnerable on-prem Exchange Server that exposes Exchange services to account holders is in scope. No public proof-of-concept is known, the flaw is not in CISA's KEV catalog, and EPSS currently estimates only a 0.8% chance of exploitation in the next 30 days, so there is no confirmed in-the-wild exploitation at this time.

What to do: Monitor Microsoft's advisory and apply the released Exchange Server security update as soon as it is available, prioritizing internet-facing Exchange servers. Because exploitation requires a valid account, review for compromised or low-privilege accounts with Exchange access and restrict which accounts can reach Exchange services from external networks. Until patched, limit exposure of OWA/EWS endpoints to trusted networks and watch server logs for unexpected file path parameters or anomalous process activity.