CVE-2026-62911

This is a Microsoft Exchange Server weakness that can let a bad actor take over more powerful permissions than they should have. Think of it like someone finding a way to “pretend” they are an allowed user by reusing a legitimate network exchange—then using that to access higher-level control. If you run Exchange, that higher control can lead to email/account compromise and serious disruption.

This matters if your business runs Microsoft Exchange Server (including Exchange Server Subscription Edition and the listed Exchange 2016/2019 cumulative update levels). Because the issue is an elevation-of-privilege flaw that relies on an authenticated attacker and capture-replay behavior, it’s most relevant when an attacker can reach Exchange and has some form of valid access to replay.

Bottom line: treat this as a real risk if your Exchange environment is reachable over the network and could be accessed by an attacker who already has (or can obtain) legitimate authenticated access.

This is RED urgency because press attention ties the exploitation activity to the Lazarus group, meaning a motivated attacker is involved. Even though no public exploit code is recorded and it’s not listed in CISA KEV, the attacker behavior reported for Exchange makes this a priority fix.

Act now to upgrade to the fixed Exchange versions for your specific branch.

1. Inventory what you run:

   • Determine whether you use Exchange Server Subscription Edition, Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Update 14, Exchange Server 2019 Cumulative Update 15, or Exchange Server Subscription Edition RTM.
   • Record the exact installed build/version from your Exchange server.

2. Confirm exposure:

   • If your Exchange build matches any of the affected items above, you are in the vulnerable population.
   • If you’re already on a later build than the fixed versions below, you’re likely not affected—still confirm with the exact build number.

3. Upgrade to the exact fixed version for your branch (per Microsoft):

   • Exchange Server Subscription Edition → fixed in 15.02.2562.046
   • Microsoft Exchange Server 2016 Cumulative Update 23 → fixed in 15.01.2507.072
   • Microsoft Exchange Server 2019 Cumulative Update 14 → fixed in 15.02.1544.044
   • Microsoft Exchange Server 2019 Cumulative Update 15 → fixed in 15.02.1748.049
   • Microsoft Exchange Server Subscription Edition RTM → fixed in 15.02.2562.046

4. Validate after patching:

   • Verify the Exchange build/version now reports the target fixed version.
   • Confirm Exchange services are healthy (no unexpected startup/runtime issues).

5. Compensating steps if you cannot patch immediately:

   • Restrict network access to Exchange to only required users/admins (limit who can reach Exchange from the network).
   • Reduce public exposure of Exchange services wherever feasible until the upgrade is applied.

6. What to monitor:

   • Look for unusual privilege-related events and administrative actions in Exchange/Windows security logs after the exposure window.
   • If you find suspicious activity, coordinate incident response with your IT/security provider.

7. Reference:

   • Microsoft update guidance for CVE-2026-62911: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911

CISA KEV note:

• This CVE is not listed in the CISA KEV set per the provided findings, but press reporting still indicates attacker interest.

CVE-2026-62911 is a Microsoft Exchange Server elevation of privilege issue (CWE-294). The described mechanism is an authentication bypass using capture-replay behavior, which can let an attacker who already has some legitimate authenticated capability replay traffic to gain higher permissions.

Exploitation status: The findings indicate press attention involving the Lazarus group. No KEV listing was provided, and no public exploit code is on record.

Fix availability: Microsoft has released remediation with clear fixed build targets for Exchange Server Subscription Edition, Exchange Server 2016 CU23, Exchange Server 2019 CU14, Exchange Server 2019 CU15, and Subscription Edition RTM. Because this is RED, prioritize upgrading those builds matching your environment.

Prediction data (not decisive): EPSS prediction is low and flat in the provided findings; however, attacker activity reported via press overrides predictive likelihood for prioritization.