Brief Summary: Microsoft Exchange Server SE CVE-2026-118207 Authenticated Remote Code Execution

Introduction

Microsoft's November 2026 Patch Tuesday shipped nine Exchange Server fixes, and only one of them carries a Critical rating: CVE-2026-118207, an authenticated remote code execution flaw in Exchange Server Subscription Edition that needs only low-level access and no user interaction. For organizations still running Exchange on premises, including hybrid servers kept around purely for management, a valid low-privileged account is the main prerequisite between an attacker and code execution on a mail server.

Below is a short review of what Microsoft and other sources have actually published, what they have not, and how the KB5133453 update closes the issue.

Technical information

What Microsoft has disclosed

The advisory description reads: "Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network." The FAQ is more specific: an authenticated attacker with low-level access to an affected server could send "a specially crafted request to execute code on the server." No other user has to open a file, click a link, or approve anything.

The NVD record (published November 10, 2026, status Awaiting Analysis) carries Microsoft's CVSS v3.1 assessment:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

That is network attack vector, low complexity, low privileges, no user interaction, unchanged scope, and high impact to confidentiality, integrity, and availability. Microsoft's full vector appends the temporal metrics:

E:U/RL:O/RC:C

Those are Unproven exploit code maturity, an Official Fix, and Confirmed report confidence. Key numbers:

• CVSS base score: 8.8 (High)
• CVSS temporal score: 7.7
• Exploitability subscore: 2.8
• Impact subscore: 5.9
• Microsoft severity rating: Critical

The Critical vendor rating and the High CVSS band come from two different labeling systems, so they do not contradict each other. Both are worth carrying into internal risk communication.

Root cause: CWE-706 plus input validation

Microsoft maps the bug to CWE-706, Use of Incorrectly Resolved Name or Reference. MITRE defines this as using a name or reference that resolves to a resource outside the intended control sphere. It is a broad, Class-level weakness that is not tied to a particular language or technology, so on its own it does not tell us which Exchange component is affected.

Combining the CWE label with the advisory wording gives a reasonable picture of the bug class. Exchange appears to take a name or reference from an incoming request (an object, type, path, or identifier, for example) and resolve it to something more powerful than the caller should be able to reach, because the input is not validated tightly enough before resolution. Fixes for this kind of defect typically restrict which names can be resolved, or check what a name resolves to before acting on it.

This is an inference from the CWE assignment and advisory language. Microsoft has not published source code, a patch diff, or a technical write-up for this fix.

Attack flow

Based on what Microsoft has published, the exploitation sequence is:

1. The attacker obtains authenticated, low-level access to an affected Exchange SE server.
2. The attacker sends a specially crafted request to the server over the network.
3. Exchange mishandles a name or reference in that request, and code executes on the server.

Tenable's independent Patch Tuesday coverage likewise describes malformed input from an authenticated attacker leading to arbitrary code execution, but it does not identify an endpoint or publish a payload.

What is not known

The reviewed disclosures do not publish a request format, affected URL or endpoint, payload, specific role or permission name, the account under which code executes, or a demonstrated exploit chain. Claims that exploitation yields SYSTEM-level execution or domain compromise are therefore not supported by current sources.

Exploitability assessment

• Microsoft at original publication: not publicly disclosed, not exploited, and rated Exploitation More Likely.
• Exploit code maturity: Unproven.
• CISA SSVC values embedded in the NVD record: exploitation none, automatable no, technical impact total.
• No named threat actor, campaign, public exploit, or CVE-specific indicators have been identified. CISA KEV listing status is unconfirmed in the material we reviewed.

Microsoft's Exploitability Index defines Exploitation More Likely as an assessment that exploit code could be created to exploit the vulnerability consistently. That is a statement about feasibility, separate from Exploitation Detected, which signals awareness of real exploitation. So there is no observed campaign, but Microsoft expects reliable exploitation to be achievable.

Patch information

Microsoft fixed CVE-2026-118207 in the regular Patch Tuesday release of November 10, 2026, delivered as an Exchange Server Security Update (SU): KB5133453, Microsoft Exchange Server Subscription Edition RTM SU12. The RL:O temporal metric means Microsoft considers this a complete vendor fix rather than a workaround or interim hotfix.

Package details

• Product: Microsoft Exchange Server Subscription Edition (SE) RTM
• KB article: KB5133453
• Package: ExchangeSubscriptionEdition-KB5133453-x64-en.exe
• SHA256 (en): C0703944B9E2E7B8980DAEF0A582761C2BBA9AD10DA99E2C79E1759DC9897D34
• Fixed build: 15.02.2562.057 (often written 15.2.2562.57)
• Supersedes: KB5128895 (October 13, 2026 SU)
• Supported operating systems listed on the download page: Windows Server 2019, 2022, and 2025

This is not a Windows update. One upstream claim needs correcting. The fix is not part of the Windows cumulative update. KB5133453 is a standalone Exchange package from the Microsoft Download Center and must be installed on the Exchange server itself. Installing November's Windows updates does nothing for this CVE.

Bundled fixes. KB5133453 is cumulative for the month. Alongside CVE-2026-118207 it addresses eight other Exchange CVEs:

• Remote code execution: CVE-2026-118149
• Elevation of privilege: CVE-2026-118150, CVE-2026-118151, CVE-2026-118154, CVE-2026-118157
• Spoofing: CVE-2026-118152, CVE-2026-118208
• Denial of service: CVE-2026-118153

It also includes one fix unrelated to security, for incorrect free/busy data in Microsoft Graph in hybrid deployments. CVE-2026-118207 is the only one of the nine rated Critical. Because the SU replaces the October package, a server on build 15.2.2562.57 has every earlier SE security fix plus this one.

Deployment and validation, per Microsoft's guidance:

1. Run the Exchange Server Health Checker to inventory servers and identify applicable updates. Use the Exchange Update Assistant for CU-specific instructions.
2. Install the SU. Exchange SUs are cumulative and CU-specific. You do not need to install every preceding SU or HU in sequence if your CU is supported by this SU.
3. Restart before and after updating. The Download Center instructions call for temporarily disabling antivirus during installation and enabling it again afterward. This is an installation step, not a vulnerability workaround.
4. After setup, reboot and confirm Exchange services started properly. Disabled services can indicate an interrupted installation.
5. Confirm ExSetup.exe reports file version 15.2.2562.57 or later, then run Health Checker again to verify the install and flag any remaining manual steps. For failures, Microsoft points administrators to SetupAssist and its failed update repair guidance.

Scope reminders. Install the SU on hybrid Exchange servers even if they are used only for management, and include servers and workstations running the Exchange Management Tools. Exchange Online customers are already protected and need no action for this release, but that does not exempt any remaining local Exchange components.

Related but separate issue. The November Windows Server updates fix October's RPC Endpoint Mapper problem, which knocked mailbox databases offline. That issue is unrelated to this CVE, and the Exchange SU alone does not fix it. Microsoft states the Exchange and Windows updates can be installed in either order.

Workarounds. The advisory provides no workaround or compensating mitigation. The documented response is the SU and Microsoft's associated validation steps.

Affected systems and versions

• Microsoft Exchange Server Subscription Edition RTM, x64: versions from 15.02.0.0 up to but not including 15.02.2562.057 are affected.
• Fixed in: 15.02.2562.057 (KB5133453, SU12).
• Hybrid Exchange servers, including those used only for management, running affected SE builds.
• Exchange Management Tools installations on servers and workstations should be included in update deployment.
• Exchange Online: Microsoft states customers are already protected.
• Exchange Server 2016 and 2019: not listed as affected, but this is not a statement that they are safe. Both reached the end of their updates in October 2026, receive no fix, and are no longer tested for vulnerabilities. Microsoft recommends upgrading immediately. Franky's Web notes this is the first Patch Tuesday where only Exchange SE received an update, and that SE and Exchange 2019 CU15 share a very similar code base, so the bug may well exist there too.

Vendor security history

Exchange Server has a documented record as a high-value target, though none of the following incidents is linked to CVE-2026-118207.

• HAFNIUM, March 2021. Microsoft attributed targeted attacks on on-premises Exchange Server to HAFNIUM with high confidence, assessing it as state sponsored and operating out of China. The vulnerabilities enabled access to servers and mailboxes, with web shells deployed after initial compromise. By March 5, Microsoft reported increased exploitation of unpatched systems by multiple actors beyond HAFNIUM. That is how Exchange exploitation can broaden after disclosure.
• Storm-0558, summer 2023. The Cyber Safety Review Board found that Storm-0558 used a stolen 2016 Microsoft Services Account signing key to forge authentication tokens, and that a token validation flaw let a consumer key access enterprise Exchange Online accounts, including at the State and Commerce departments. The Board concluded Microsoft's security culture was inadequate and cited avoidable errors. This was a cloud identity failure, not an Exchange Server request-handling bug like the one discussed here.
• Secure Future Initiative, July 2026. Microsoft reports 99.97% phishing-resistant MFA coverage for users and devices, 1.4M unused Entra applications decommissioned, and 98.7% credential isolation across boundaries. These are vendor-reported figures, not independent evidence that defects like this one are prevented.

For this CVE specifically, the more concrete signal is the response itself: an advisory, an official cumulative SU, deployment guidance, and validation tooling, all published on disclosure day.

References

• NVD entry for CVE-2026-118207
• CVE record for CVE-2026-118207
• Microsoft Security Update Guide: CVE-2026-118207
• NVD API record for CVE-2026-118207
• Microsoft Support: Security update for Exchange Server SE RTM, November 10, 2026 (KB5133453)
• Microsoft Download Center: Exchange Server SE RTM SU12 (KB5133453)
• Exchange Team Blog: Released November 2026 Exchange Server Security Updates
• Franky's Web: New security updates for Exchange Server, November 2026
• Microsoft Learn: Exchange Server update FAQ
• Microsoft Learn: Exchange Server build numbers and release dates
• Tenable: November 2026 Microsoft Patch Tuesday
• Zero Day Initiative: The November 2026 Security Update Review
• OffSeq Threat Radar: CVE-2026-118207
• MITRE CWE-706: Use of Incorrectly Resolved Name or Reference
• Microsoft Exploitability Index
• CISA Known Exploited Vulnerabilities Catalog
• CISA KEV JSON feed
• Microsoft Security Blog: HAFNIUM targeting Exchange Servers with 0day exploits
• CSRB: Review of the Summer 2023 Microsoft Exchange Online Intrusion
• Microsoft Trust Center: SFI Progress Report July 2026
• European Commission: Commitments offered by Microsoft related to Teams