CVE-2026-45504

Microsoft Exchange Server is the system many businesses use to run email inside and outside the company. This bug can let someone who already has a small foothold inside Exchange use it to gain much higher control—like going from “limited staff account” to “admin,” with no need for a user to click anything. That higher control can lead to exposure of sensitive email data and can also disrupt the service.

This matters if you run Microsoft Exchange Server (including Exchange Server Subscription Edition, or Exchange Server 2016 Cumulative Update 23, or Exchange Server 2019 Cumulative Update 14/15). The vulnerability requires low-level access (not full admin) and can be triggered over the network without any user interaction. Because the exact “reachable in default config” and other preconditions aren’t confirmed in the provided findings, treat it as relevant whenever an attacker could reach Exchange and have low-level access to leverage the issue.

This is urgent because it enables an attacker with low-level access to escalate privileges over the network, and Microsoft Exchange is a high-value target for attackers. Even though there’s no confirmed public exploit code in the findings, the combination of network reachability and privilege escalation makes it a serious risk for businesses running Exchange. Patch as a RED priority.