Microsoft has corrected seven vulnerabilities in Exchange Server that could enable remote code execution, privilege escalation, denial of service, content spoofing, and security feature bypass.
The most critical flaw, CVE-2026-62913, received a CVSS score of 8.8. It consists of a heap buffer overflow that an attacker with low privileges can exploit over the network without requiring additional victim interaction. A successful attack can lead to arbitrary code execution on the server, opening pathways for stealing email mailboxes, installing persistence mechanisms, performing lateral movement, and deploying ransomware.
CVE-2026-62911 also stands out because it permits bypassing authentication controls through credential capture and replay. The vulnerability was demonstrated at Pwn2Own Berlin and carries a CVSS score of 8.0.
The update package further resolves privilege escalation issues, including an SSRF vulnerability, as well as a deserialization problem capable of remotely crashing the Exchange Server. Additional flaws allow spoofing of content shown to users and bypassing authorization checks. Together, these issues expand the attack surface after an attacker gains initial access to the environment.
The fixes apply to Exchange Server Subscription Edition. Exchange Server 2016 and Exchange Server 2019 are outside mainstream support and receive patches only for organizations enrolled in the Extended Security Update program.
