CVE-2026-62910: Microsoft Exchange Server Elevation of Privilege Vulnerability

Analysis on rafaelpfister.ch

Article · August 19, 2026 August 2026 Exchange Security Updates: Pwn2Own Vulnerability Fixed, OWA Light Disabled The August SU fixes seven vulnerabilities, including the Exchange exploit demonstrated at Pwn2Own 2026, and permanently disables OWA Light. Microsoft also explains why Exchange SUs are now released monthly and why Exchange SE CU1 is still delayed.

Vendor description

Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Reference data

Vendor

Microsoft

Affected products

Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft Exchange Server Subscription Edition RTM

CVSS 3.1

7.2 (HIGH)

Vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Weakness type

CWE-99: Improper Control of Resource Identifiers ('Resource Injection')

Published

August 11, 2026

Official sources

← All vulnerabilities