CVE-2026-118149: Microsoft Exchange Server Remote Code Execution Vulnerability | Rafael Pfister

Analysis on rafaelpfister.ch

Article · November 11, 2026 November 2026 Exchange security updates: nine vulnerabilities, first update only for Exchange SE The November SU closes nine vulnerabilities in Exchange Server SE, including a critical remote code execution for which a low-privileged account is sufficient. Exchange 2016 and 2019 no longer receive updates. The November Windows updates fix the Exchange outages caused by the October Windows updates.

Vendor description

Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

Reference data

Vendor

Microsoft

Affected products

Microsoft Exchange Server Subscription Edition RTM

CVSS 3.1

8.8 (HIGH)

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Weakness type

CWE-94: Code Injection

Published

November 10, 2026

Official sources

← All vulnerabilities