CVE-2026-87692 Microsoft Exchange Server Elevation of Privilege Vulnerability

Vendor description

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Reference data

Vendor

Microsoft

Affected products

• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Update 14
• Microsoft Exchange Server Subscription Edition RTM

CVSS 3.1

7.8 (HIGH)

Vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Weakness type

CWE-502: Deserialization of Untrusted Data

Published

October 13, 2026

Official sources

• CVE.org
• NVD
• Vendor advisory

← All vulnerabilities