CVE-2026-62912: Microsoft Exchange Server Denial of Service Vulnerability | Rafael Pfister

Analysis on rafaelpfister.ch

Article · August 19, 2026 August 2026 Exchange Security Updates: Pwn2Own Vulnerability Fixed, OWA Light Disabled The August SU fixes seven vulnerabilities, including the Exchange exploit demonstrated at Pwn2Own 2026, and permanently disables OWA Light. Microsoft also explains why Exchange SUs are now released monthly and why Exchange SE CU1 is still delayed.

Vendor description

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to deny service over a network.

Reference data

Vendor

Microsoft

Affected products

Microsoft Exchange Server 2016 Cumulative Update 23
Microsoft Exchange Server 2019 Cumulative Update 14
Microsoft Exchange Server 2019 Cumulative Update 15
Microsoft Exchange Server Subscription Edition RTM

CVSS 3.1

6.5 (MEDIUM)

Vector

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C

Weakness type

CWE-502: Deserialization of Untrusted Data

Published

August 11, 2026

Official sources

← All vulnerabilities