CVE-2026-118149: Authenticated Code Injection Leading to Remote Code Execution in Microsoft Exchange Server SE

Introduction

Any authenticated user with low privileges on a Microsoft Exchange Server Subscription Edition deployment could send a crafted network request and cause the server to execute code, with no other user involved. Because Exchange is the backend that stores and synchronizes enterprise mail, Microsoft's November 10, 2026 fix for CVE-2026-118149 applies to every Exchange SE server and to every machine running the Exchange Management Tools, hybrid organizations included.

Technical information

Root cause: CWE 94 code injection

Microsoft classifies CVE-2026-118149 as CWE 94, Improper Control of Generation of Code (Code Injection). MITRE defines this weakness as constructing a code segment from externally influenced input without correctly neutralizing elements that can change the syntax or behavior of the intended code. In practice, data supplied by the attacker ends up inside code or an expression that the server then evaluates.

That definition describes the weakness class, not the specific Exchange defect. Exchange is closed source and there is no public commit or diff. Microsoft's advisory does not disclose:

• the affected service endpoint or request parameter
• the payload format or the vulnerable function
• the Exchange role that must be reachable
• the account under which injected code executes

We therefore cannot responsibly name a specific protocol, interpreter, or exploit chain, and we do not reproduce any vulnerable code because none has been published.

CVSS vector

Microsoft publishes the following vector:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

• Attack Vector: Network. Exploitation occurs through network access to the affected service.
• Attack Complexity: Low.
• Privileges Required: Low. The attacker must be authenticated.
• User Interaction: None. No victim needs to open content or click anything.
• Scope: Unchanged.
• Confidentiality, Integrity, Availability: High. These describe the potential impact of successful exploitation, not an observed incident.

The base score is 8.8 (High). The temporal score is 7.7, which reflects exploit code maturity of Unproven, remediation level of Official Fix, and report confidence of Confirmed. Microsoft's own product severity rating is Important. The two labels come from different rating systems and do not contradict each other. NVD displays Microsoft's score but notes that its own assessment has not yet been provided, so the NVD figure should not be read as an independent NIST determination.

Attack flow

Based on the advisory, the publicly described sequence is short:

1. The attacker obtains authenticated access to the Exchange environment with low privileges.
2. The attacker sends a specially crafted request over the network to an affected Exchange service.
3. The service processes the request, and attacker-influenced data reaches a code generation or evaluation path without adequate neutralization (this step reflects the CWE 94 class; Microsoft has not identified the component).
4. Code executes on the target system.

The authentication requirement narrows who can attempt this. Still, the lack of required user interaction, the low complexity rating, and the high impact ratings keep it significant for any organization with a broad authenticated user population.

Exploitability at publication

Microsoft's original assessment recorded "Publicly disclosed: No", "Exploited: No", and "Exploitation Unlikely". The CISA ADP SSVC entry in the CVE record, timestamped November 10, 2026 at 19:45:56 UTC, records "Exploitation: none", "Automatable: no", and "Technical Impact: total". The cited sources associate no threat actor, campaign, malware family, or indicators of compromise with this CVE. These are time-qualified assessments and do not establish that exploitation cannot occur later.

Patch information

The fix ships in a single cumulative Security Update rather than a public code change. Microsoft resolved CVE-2026-118149 in the November 10, 2026 Security Update for Exchange Server SE RTM, published as KB5133453 and referred to as Exchange SE RTM SU12.

Microsoft has not stated which component or code path SU12 changed, so no specific remediation technique (validation, allow listing, or removal of a dynamic evaluation path) can be confirmed. The RL:O temporal metric marks the update as a complete vendor solution rather than a workaround.

Package details

• Product: Microsoft Exchange Server Subscription Edition RTM
• KB: KB5133453 (SU12)
• Fixed build: 15.02.2562.057 (shown by community sources as 15.2.2562.57)
• Package: ExchangeSubscriptionEdition-KB5133453-x64-en.exe
• SHA256: C0703944B9E2E7B8980DAEF0A582761C2BBA9AD10DA99E2C79E1759DC9897D34
• Supersedes: KB5128895 (October 13, 2026 SU)

The package is available from the Microsoft Download Center. Microsoft also publishes per-language hash CSVs and a file information CSV listing every binary the update replaces. Comparing that list with the October SU file list is the quickest way to narrow down which assemblies changed.

SU12 addresses nine Exchange CVEs together: CVE-2026-118149, CVE-2026-118150, CVE-2026-118151, CVE-2026-118152, CVE-2026-118153, CVE-2026-118154, CVE-2026-118157, CVE-2026-118207 and CVE-2026-118208. It also fixes a nonsecurity bug where Microsoft Graph returned incorrect free/busy information in hybrid configurations.

Deployment scope

Exchange SUs are cumulative, so a server on the supported SE RTM baseline can install SU12 directly without applying earlier SUs first. Microsoft states the SU should be installed on:

• every Exchange server
• every machine running only the Exchange Management Tools
• Exchange servers in hybrid deployments, even though Exchange Online is already protected

Installation and verification

Microsoft's documented workflow is:

1. Run the Exchange Server Health Checker to identify missing cumulative updates, security updates, or manual actions.
2. Install SU12.
3. Reboot and confirm that all Exchange services start. Services left disabled indicate an interrupted installation. Consult Microsoft's installation troubleshooting guidance.
4. Run Health Checker again to confirm the SU applied cleanly and to flag any remaining manual steps.
5. If setup or subsequent errors occur, run SetupAssist and follow Microsoft's failed update repair guidance.

The installed build is the file version of Exsetup.exe. Community write-ups of this release use the following command:

Get-Command Exsetup.exe | ForEach-Object {$_.FileVersionInfo}

If the output shows build 15.2.2562.57 or later, the CVE-2026-118149 fix is in place.

Related release notes

The November release post also covers instability some Exchange servers experienced after the October 2026 Windows Server updates. The November 2026 Windows Server updates fix that issue, not this Exchange SU. Once those Windows updates are installed, the previously used registry key is no longer required, and installation order does not matter. This is deployment guidance, not a substitute fix for CVE-2026-118149.

Microsoft has not published a dedicated workaround or compensating control for this CVE. The supported remediation is the official update.

Affected systems and versions

• Microsoft Exchange Server Subscription Edition RTM, x64: versions from 15.02.0.0 up to, but not including, 15.02.2562.057 are affected.
• Fixed build: 15.02.2562.057 (15.2.2562.57) via KB5133453 (SU12).
• Exchange Management Tools: Microsoft puts machines running only the management tools in scope for the update.
• Hybrid deployments: on-premises Exchange servers require the update even though Exchange Online is already protected.
• Exchange Online: Microsoft states customers are already protected.
• Exchange Server 2016 and 2019: not listed in the affected product entry, which is not an assurance of safety. Microsoft states these versions are out of support, are no longer tested for vulnerabilities, received no update in this release, and should be considered "permanently vulnerable." Upgrading to Exchange SE is the only vendor-supported way to obtain this fix.

Vendor security history

Exchange has a well-documented history of serious security events. They are useful context, and nothing below implies a link to CVE-2026-118149.

2021 Exchange Server exploitation. The Canadian Centre for Cyber Security documented remote exploitation of the unauthenticated SSRF flaw CVE-2021-26855, chained with further vulnerabilities that enabled code execution or file writes. Actors deployed web shells, and the alert discusses data theft, ransomware and DearCry, with references to Microsoft's HAFNIUM reporting. Unlike CVE-2026-118149, that chain did not require authentication, and harm was documented.

2023 Exchange Online intrusion. The Cyber Safety Review Board's review attributes the intrusion to Storm-0558, which combined a stolen 2016 Microsoft account signing key with the ability to access enterprise Exchange accounts and reached email at 22 enterprise organizations, including government agencies and think tanks. This was a cloud identity incident, not a server code injection bug. The Board criticized Microsoft's delay in correcting public statements implying the key had been found in a crash dump, and cited a corporate culture that deprioritized enterprise security investment and rigorous risk management.

Secure Future Initiative. Microsoft's July 2026 SFI progress report claims 99.97% phishing-resistant MFA coverage for covered users and devices, removal of public access from 732,000 resources, and centrally governed templates for 93% of critical and high-value build pipelines. These are internal program measures, not Exchange-specific controls. Independent coverage has been cautiously positive, while warning that urgency around AI could erode security discipline and that the improvements must be sustained.

Separately, a public proof of concept has been reported for CVE-2026-62911, a different Exchange vulnerability. It is not evidence regarding CVE-2026-118149.

References

• NVD: CVE-2026-118149
• CVE Record: CVE-2026-118149
• Microsoft Security Update Guide: CVE-2026-118149
• Microsoft Support: KB5133453
• Description of the security update for Exchange Server SE RTM November 10, 2026 (KB5133453)
• Released: November 2026 Exchange Server Security Updates (Exchange Team Blog)
• FrankysWeb: New security updates for Exchange Server, November 2026
• Icewolf Blog: Exchange Server SE SU12 has been released
• CVE JSON record (cveawg.mitre.org)
• CWE 94: Improper Control of Generation of Code
• Exchange Server build numbers and release dates
• Exchange Server 2019 and 2016 End of Support Roadmap
• Canadian Centre for Cyber Security: Active Exploitation of Microsoft Exchange Vulnerabilities
• CSRB Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft SFI Progress Report July 2026
• Cybersecurity Dive: Inside Microsoft's security transformation
• TechTarget: Microsoft SFI progress report elicits cautious optimism
• heise online: Proof of Concept for Exchange vulnerability released (CVE-2026-62911)
• CISA Known Exploited Vulnerabilities Catalog
• Microsoft Exchange product page