CVE-2026-62913

Think of Microsoft Exchange Server as the “front door and mail room” for your email system. This bug lets someone who already has login access break out of the normal software behavior and run their own code on the Exchange server from the network. If it’s reachable and someone gains the required access, the result can be a full compromise of the server and disruption of your email.

This matters to you if you run Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, or Microsoft Exchange Server Subscription Edition RTM (including Exchange server subscription edition).

Because this requires an authenticated attacker, the risk is mainly about whether someone can obtain valid login credentials and then reach the Exchange server over the network. As a practical gate: the threat is relevant when your Exchange server is network-reachable and an attacker can get the necessary authenticated access (even if they can’t do anything without that login).

This should be treated as RED because the vulnerability is remote code execution, and the attack can be triggered by an attacker who has valid login access and network reachability. Even though the provided material does not report active exploitation specifically for CVE-2026-62913, the actor attention (notably Lazarus group) and the impact of server code execution make it urgent to patch.

Act now to remove the known vulnerable software states by moving to the Microsoft-fixed builds for your Exchange version.