CVE-2026-118208: Microsoft Exchange Server Spoofing Vulnerability | Rafael Pfister

Analysis on rafaelpfister.ch

Article · November 11, 2026 November 2026 Exchange security updates: nine vulnerabilities, first update only for Exchange SE The November SU closes nine vulnerabilities in Exchange Server SE, including a critical remote code execution for which a low-privileged account is sufficient. Exchange 2016 and 2019 no longer receive updates. The November Windows updates fix the Exchange outages caused by the October Windows updates.

Vendor description

Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.

Reference data

Vendor

Microsoft

Affected products

Microsoft Exchange Server Subscription Edition RTM

CVSS 3.1

7.1 (HIGH)

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L/E:U/RL:O/RC:C

Weakness type

CWE-15: External Control of System or Configuration Setting

Published

November 10, 2026

Official sources

← All vulnerabilities