Quick Look: CVE-2026-118150, a Microsoft Exchange Server SE Authorization Bypass Enabling Privilege Escalation

Introduction

Microsoft's November 10, 2026 Exchange Server security update closes an authorization flaw that lets an attacker who already holds a valid, low-privileged account elevate privileges over the network, with no user interaction required. For organizations still running Exchange Server Subscription Edition on premises, including servers retained only for hybrid management, installing the update is the only published remediation. It ships as part of a cumulative package that fixes eight other Exchange vulnerabilities at the same time.

Microsoft scores CVE-2026-118150 at CVSS 3.1 8.8 (High) while rating it Important in its own severity scale. At release, Microsoft reported the issue as not publicly disclosed, not exploited, and "Exploitation Less Likely". This post summarizes what is confirmed, what is not, and what the fix involves.

Technical Information

Root cause: CWE-639, Authorization Bypass Through User Controlled Key

Microsoft classifies the flaw as CWE-639. MITRE describes this weakness as a failure to prevent one user from accessing another user's data by modifying the key that identifies that data. Authentication succeeds, but the subsequent resource access check does not verify that the caller is entitled to the object being requested. MITRE associates the weakness with Insecure Direct Object Reference (IDOR) and notes overlap with Broken Object Level Authorization (BOLA).

Applied to this CVE, the practical reading is that Exchange accepted an identifier controlled by the client (for example a mailbox, object or resource key) and acted on it without checking that the authenticated user was permitted to operate on that object. The confirmed outcome, per Microsoft, is that "an authorized attacker" can "elevate privileges over a network".

MITRE's own illustration of the class is an application that returns whichever invoice matches a supplied identifier without checking ownership, so changing the identifier returns someone else's invoice. That example explains the weakness class. It is not a demonstrated Exchange exploitation method.

Scoring breakdown

The base vector is CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H:

Attack Vector: Network (AV:N). Exploitation occurs across a network.
Attack Complexity: Low (AC:L). The scoring model requires no special conditions.
Privileges Required: Low (PR:L). The attacker must already hold basic privileges, so this is not an unauthenticated entry point.
User Interaction: None (UI:N). No other user needs to participate.
Scope: Unchanged (S:U). Impact stays within the same security authority.
Confidentiality, Integrity, Availability: High. These are assessed potential consequences, not observed incident outcomes.

Microsoft also publishes a temporal score of 7.7, with the extended vector ending in E:U/RL:O/RC:C: unproven exploit maturity, an official fix, and confirmed report confidence. The drop from 8.8 to 7.7 reflects Microsoft setting Remediation Level to Official Fix. NVD currently displays the Microsoft CNA score and states that its own assessment has not yet been provided.

What the advisory does not tell us

Microsoft has not identified the vulnerable endpoint, the key or parameter name, the request format, the protocol, the security role an attacker ends up with, or a complete exploitation chain. Nothing in the published material establishes administrator or SYSTEM-level access, and there is no remote code execution payload. Exchange is closed source, and Microsoft has not published a diff or technical write-up, so there is no public commit to examine.

Conceptual attack flow

Based only on the CVSS vector and the CWE class, the scored attack conditions look like this:

The attacker holds a valid, low-privileged identity that can authenticate to the target Exchange SE server over the network.
The attacker sends an authenticated request in which a key identifying a target object has been set to a value the attacker is not entitled to reference.
The vulnerable code path resolves the object from that key and acts on it without confirming the caller's authorization, resulting in elevated privileges within the same security scope.

The specific Exchange component, request and resulting privilege level are not public. This flow maps the weakness class onto the scoring metrics. It is not a validated exploitation procedure.

Exploitation status and threat context

Microsoft's release assessment: Not publicly disclosed, not exploited, rated "Exploitation Less Likely", with exploit maturity Unproven (no public exploit code, or the exploit remains theoretical).
Secondary reporting: Senserva reports no observed exploitation as of November 11, 2026. OffSeq reports no indexed public exploit in Metasploit or Exploit DB.
CISA KEV: Senserva and OffSeq report the CVE is not in the KEV catalog. CISA's November 10, 2026 alert added six other vulnerabilities, not this one.
Attribution: No exploiting actor or campaign is named. HAFNIUM and Storm-0558 feature in earlier, unrelated Exchange incidents and should not be linked to this CVE.

Low complexity and low required privileges describe how an attack would be scored. They do not mean a working exploit is circulating. Conversely, the lack of a confirmed campaign does not reduce the assessed impact of the flaw.

An upstream source points to a Zephyr RTOS PTP advisory that mentions "#118150". That number is a Zephyr pull request reference and has nothing to do with this Exchange CVE.

Patch Information

Microsoft fixed CVE-2026-118150 in the November 10, 2026 Security Update for Exchange Server Subscription Edition RTM, SU12 (KB5133453). The MSRC Security Update Guide lists KB5133453 as the only update for this CVE, with fixed build 15.02.2562.057, matching the CNA data on NVD.

Update: Exchange Server SE RTM SU12
KB: KB5133453
Release date: November 10, 2026
Fixed build: 15.02.2562.057 (also written 15.2.2562.57)
Replaces: KB5128895 (October 13, 2026 SU)
English package: ExchangeSubscriptionEdition-KB5133453-x64-en.exe
SHA256 (English package): C0703944B9E2E7B8980DAEF0A582761C2BBA9AD10DA99E2C79E1759DC9897D34

Hashes for packages in other languages are in the language CSV linked from the KB article.

What the fix addresses

Microsoft has not documented the code change. Fixes for CWE-639 typically do one or both of the following: verify on the server that the caller may access the object behind the supplied key before acting on it, or stop trusting the client's key and resolve the target object from the authenticated session instead. This is an inference from the weakness class, not something Microsoft has stated about this CVE.

A bundled, cumulative update

KB5133453 fixes nine Exchange vulnerabilities, not just this one: CVE-2026-118149, CVE-2026-118150, CVE-2026-118151, CVE-2026-118152, CVE-2026-118153, CVE-2026-118154, CVE-2026-118157, CVE-2026-118207 and CVE-2026-118208. It also includes a fix, not security related, for incorrect free/busy data in Microsoft Graph in hybrid setups. The fix for CVE-2026-118150 cannot be installed separately.

SUs are cumulative. A server on a supported build can install SU12 directly without installing earlier SUs in sequence.
Install it everywhere Exchange code runs. Microsoft recommends every Exchange server plus any server or workstation with the Exchange Management Tools, including servers kept only for hybrid management.
Exchange Online was already protected and needs no customer action. Moving mailboxes to the cloud does not remove the update requirement for retained management servers.
Exchange Server 2016 and 2019 receive no update. Microsoft says they are no longer tested for vulnerabilities and should be treated as permanently vulnerable. Moving to Exchange SE is the only way to get the fix.

Deployment and verification

Run the Exchange Server Health Checker to inventory servers and identify missing updates before deploying.
Download KB5133453 from the official Microsoft Download Center.
Microsoft's update FAQ recommends restarting before and after updates. After setup, reboot and confirm that all Exchange services have started. Services left disabled indicate an interrupted installation.
Use SetupAssist to investigate installation errors.
Run Health Checker again after installation to confirm the update applied and to flag any further required actions.
Any SE server below build 15.2.2562.57 remains exposed.

Microsoft's November guidance also notes an instability issue associated with the October 2026 Windows Server updates and directs customers to install the November 2026 Windows Server updates. The Exchange and Windows November updates may be installed in either order. If the authentication certificate is changed after the SU is applied, rerun the Hybrid Configuration Wizard. These are update-related instructions, not alternative fixes for the authorization flaw. No published configuration workaround exists for this CVE.

Affected Systems and Versions

Product: Microsoft Exchange Server Subscription Edition RTM, x64 based systems
Affected range: builds from 15.02.0.0 up to, but not including, 15.02.2562.057
Fixed build: 15.02.2562.057 (KB5133453, SU12)
Configurations in scope: all Exchange SE RTM servers below the fixed build, including servers retained only for hybrid management, and machines running the Exchange Management Tools
Exchange Online: already protected by Microsoft
Exchange Server 2016 and 2019: not listed in the CVE record's affected data. Microsoft states these versions receive no update, are no longer tested for vulnerabilities, and should be treated as permanently vulnerable.

The CVE record does not establish the status of every other Exchange edition or historical release.

Vendor Security History

Microsoft is both the vendor and the CVE Numbering Authority for this record. Exchange is Microsoft's server technology for email, calendars, contacts and tasks, available on premises, as Exchange Online, and in hybrid deployments. The UK Competition and Markets Authority's May 14, 2026 announcement describes more than 15 million commercial users across Microsoft's UK business software ecosystem. That is an ecosystem figure, not Exchange market share, and the CMA states the investigation does not assume wrongdoing.

Exchange has a documented incident history, though none of it involves this CVE:

HAFNIUM (2021): Microsoft attributed limited, targeted attacks on on-premises Exchange servers to HAFNIUM, assessed as state sponsored and operating from China, involving email account access and additional malware for persistence. Exchange Online was not affected by those vulnerabilities. CISA documented active exploitation and advised organizations finding exploitation activity to assume network identity compromise and follow incident response procedures.
Storm-0558 (2023): The Cyber Safety Review Board found that Storm-0558 used a Microsoft signing key to access enterprise Exchange Online accounts, concluded the intrusion was preventable, and described Microsoft's security culture as inadequate and requiring an overhaul.
Secure Future Initiative (July 2026): Microsoft self-reports 99.97% user and device coverage for phishing-resistant MFA enforcement and removal of public access from 732,000 resources. These are vendor-reported program metrics and say nothing specific about this authorization defect.

Each of these cases rests on different mechanisms and evidence. CVE-2026-118150 is a confirmed, patched privilege-escalation flaw with no confirmed exploitation at release. The right response is to install and validate KB5133453, not to borrow attribution from earlier incidents.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical Information