CVE-2026-62911

This is a Microsoft Exchange Server weakness that can let a bad actor take over more powerful permissions than they should have. Think of it like someone finding a way to “pretend” they are an allowed user by reusing a legitimate network exchange—then using that to access higher-level control. If you run Exchange, that higher control can lead to email/account compromise and serious disruption.

This matters if your business runs Microsoft Exchange Server (including Exchange Server Subscription Edition and the listed Exchange 2016/2019 cumulative update levels). Because the issue is an elevation-of-privilege flaw that relies on an authenticated attacker and capture-replay behavior, it’s most relevant when an attacker can reach Exchange and has some form of valid access to replay.

Bottom line: treat this as a real risk if your Exchange environment is reachable over the network and could be accessed by an attacker who already has (or can obtain) legitimate authenticated access.

This is RED urgency because press attention ties the exploitation activity to the Lazarus group, meaning a motivated attacker is involved. Even though no public exploit code is recorded and it’s not listed in CISA KEV, the attacker behavior reported for Exchange makes this a priority fix.

Act now to upgrade to the fixed Exchange versions for your specific branch.