CVE-2026-118151: Microsoft Exchange Server Elevation of Privilege Vulnerability | Rafael Pfister

Analysis on rafaelpfister.ch

Article · November 11, 2026 November 2026 Exchange security updates: nine vulnerabilities, first update only for Exchange SE The November SU closes nine vulnerabilities in Exchange Server SE, including a critical remote code execution for which a low-privileged account is sufficient. Exchange 2016 and 2019 no longer receive updates. The November Windows updates fix the Exchange outages caused by the October Windows updates.

Vendor description

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Reference data

Vendor

Microsoft

Affected products

Microsoft Exchange Server Subscription Edition RTM

CVSS 3.1

7.2 (HIGH)

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Weakness type

CWE-73: External Control of File Name or Path

Published

November 10, 2026

Official sources

← All vulnerabilities