CVE-2026-118153: Microsoft Exchange Server Denial of Service Vulnerability | Rafael Pfister

Analysis on rafaelpfister.ch

Article · November 11, 2026 November 2026 Exchange security updates: nine vulnerabilities, first update only for Exchange SE The November SU closes nine vulnerabilities in Exchange Server SE, including a critical remote code execution for which a low-privileged account is sufficient. Exchange 2016 and 2019 no longer receive updates. The November Windows updates fix the Exchange outages caused by the October Windows updates.

Vendor description

Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.

Reference data

Vendor

Microsoft

Affected products

Microsoft Exchange Server Subscription Edition RTM

CVSS 3.1

7.5 (HIGH)

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Weakness type

CWE-407: Inefficient Algorithmic Complexity

Published

November 10, 2026

Official sources

← All vulnerabilities