CVE-2026-69380

Microsoft Exchange Server contains a missing-authorization vulnerability (CWE-862) in which a network-accessible component fails to properly verify a caller's permissions before handling a request. An attacker who already holds valid low-privileged credentials can send crafted requests over the network to trigger the flaw and elevate privileges. The CVSS ratings show high confidentiality and integrity impact, so successful elevation likely grants access to and control over sensitive mailbox or server resources. Organizations running on-premises Microsoft Exchange Server are affected, whether the server is internet-exposed or reachable by internal users with standard accounts. As of the available data there is no public proof-of-concept, the flaw is not in CISA KEV, and EPSS estimates a 0.7% probability of exploitation within 30 days; it was addressed in Microsoft's large Patch Tuesday release per related coverage.

What to do: Apply the Exchange Server security update from Microsoft's advisory for this CVE as soon as it is available for your installed cumulative update. Because exploitation requires an authenticated low-privileged user, restrict external access to OWA/EWS and other Exchange web endpoints (VPN or IP allowlists) and audit for unexpected privilege changes or new privileged accounts. Follow Microsoft's advisory for exact affected and fixed versions, as none were specified in this data.