CVE-2026-62910

Think of Microsoft Exchange Server like the front desk and back office for your business email. This bug lets a logged-in attacker “trick” the server when it processes certain network resource addresses, and then gain higher control—like moving from a regular staff badge to an admin badge. That can lead to wider access and disruption if someone already has a valid account.

This matters if you run Microsoft Exchange Server (including Exchange Server Subscription Edition) and your installed build matches one of the affected cumulative updates listed for this CVE. It specifically requires an attacker to already have a valid, authenticated account, and no user action is needed. The risk is primarily if an attacker can reach your Exchange server and get credentials (for example, through a compromised user account), because exploitation depends on authentication.

This is RED because an authenticated attacker could elevate to higher administrative rights, which can quickly turn a stolen or misused account into full server control. While there’s no clear public evidence in the provided sources of active exploitation of this exact CVE, the required conditions (authenticated access) are realistic for real-world attacks against email systems.