Brief Summary: Microsoft Exchange Server CVE-2026-118153 Unauthenticated Denial of Service via Inefficient Algorithmic Complexity

Introduction

Microsoft's November 2026 Exchange security release fixes a flaw that lets an unauthenticated attacker on the network degrade or deny Exchange service simply by sending input that drives the server into worst-case processing. For organizations that route their critical communications through on-premises Exchange, this is an availability problem that requires no credentials and no user interaction, and it is fixed only in Exchange Server Subscription Edition.

This post is a brief summary of what Microsoft and secondary sources have published about CVE-2026-118153, what remains undisclosed, and how the fix ships.

Technical information

Root cause: CWE 407, Inefficient Algorithmic Complexity

Microsoft describes the issue as "inefficient algorithmic complexity in Microsoft Exchange Server" that "allows an unauthorized attacker to deny service over a network." MITRE defines CWE 407 as an algorithm whose worst-case computational complexity can be triggered by attacker-supplied input, harming performance through CPU consumption and potentially memory or other resource consumption.

Flaws in this class do not crash the server on malformed input. A carefully shaped request instead pushes a routine into worst-case behavior, such as quadratic or exponential processing time, so a small volume of attacker traffic consumes a disproportionate amount of CPU or worker threads. Fixes for this class usually replace the expensive algorithm, cap the size or nesting depth of the input, or add work limits so the cost per request stays bounded.

That description covers the weakness class. It does not describe the specific Exchange trigger. Exchange is closed source, and Microsoft has not published:

the affected component or endpoint (message processing, authentication, a web interface, or something else)
the request format or payload
the algorithm involved or the resource-exhaustion pattern
traffic thresholds, outage duration, or recovery procedure
which binaries in the SU12 per-file manifest (File_Info_Exchange_SE_RTM_SU12.csv) carry this specific fix

We have deliberately avoided substituting a generic example (a regular expression flaw, for instance) for these missing details.

CVSS assessment

Microsoft's base vector, reproduced by NVD and Tenable, is:

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector: Network, so the flaw is reachable remotely.
Attack Complexity: Low. The assessment requires no special conditions.
Privileges Required: None. No authentication is needed.
User Interaction: None.
Scope: Unchanged.
Confidentiality and Integrity: None. This is not a data-theft or code-execution flaw.
Availability: High. Service availability is the principal impact.

The base score is 7.5 (High), and Microsoft's own severity rating is Important. Microsoft also publishes a 6.5 temporal score, reflecting Exploit Code Maturity: Unproven, Remediation Level: Official Fix (RL:O), and Report Confidence: Confirmed. NVD has not yet completed its own enrichment of the record.

Attack flow, as far as the published data allows

Based on the vector and the advisory text, the attack conditions are:

The attacker has network reachability to an affected Exchange SE RTM server.
Without authenticating, the attacker sends input that triggers the worst-case path of the vulnerable routine.
Processing that input consumes server resources out of proportion to the request, degrading or denying Exchange service.

No exploit recipe, request signature, or resource measurement has been published, so the steps above describe the assessed conditions rather than a reproduced attack.

Exploitability status

At original publication, Microsoft marked the vulnerability Publicly disclosed: No, Exploited: No, and Exploitation Less Likely. OffSeq reports no indexed public exploit code in Metasploit or Exploit DB, no CISA KEV listing, and no exploitation evidence on record. These statements are bounded by what those sources can see, and they are not guarantees. No reviewed source attributes activity to any threat actor. Microsoft credits XlabAI with the report, which identifies a contributor rather than an attacker.

A high CVSS base score and an Exploitation Less Likely rating do not contradict each other. The score describes impact and attack conditions, and the rating describes Microsoft's view of the likelihood of observed exploitation.

Patch information

Microsoft fixed CVE-2026-118153 in its November 10, 2026 Patch Tuesday release. The fix ships in Exchange Server Subscription Edition (SE) RTM Security Update 12 (SU12), KB5133453, which the MSRC entry lists as the only remediation.

Fixed version

Product: Exchange Server SE RTM
Update: SU12 (November 2026), KB5133453
Fixed build: 15.2.2562.57 (MSRC lists it as 15.02.2562.057)
Replaces: KB5128895 (October 2026 SU)

Any Exchange SE RTM build lower than 15.2.2562.57 is unpatched for this CVE.

How the update ships

Standalone package: ExchangeSubscriptionEdition-KB5133453-x64-en.exe from the Microsoft Download Center (id 108908). Microsoft publishes its SHA256 hash as C0703944B9E2E7B8980DAEF0A582761C2BBA9AD10DA99E2C79E1759DC9897D34. Hashes for other language packs are in a separate CSV linked from the KB.
Bundled fixes: SU12 is a combined update. It also fixes CVE-2026-118149, CVE-2026-118150, CVE-2026-118151, CVE-2026-118152, CVE-2026-118154, CVE-2026-118157, CVE-2026-118207 and CVE-2026-118208, plus a non-security fix for incorrect free/busy data in hybrid Microsoft Graph lookups. The CVE-2026-118153 fix cannot be installed on its own.
Cumulative: Exchange SUs are cumulative, so servers on the supported CU need only the latest SU. Microsoft also says to install the SU on machines running only the Exchange Management Tools, and on Exchange servers used only for management.
Exchange Online: Microsoft states Exchange Online customers are already protected. The SU applies to on-premises servers and management tools machines, so hybrid organizations still have local work to do.

Installing and verifying

Microsoft's guidance is:

Run Exchange Server Health Checker to identify missing CUs, SUs, and manual actions.
Restart before installation, as the Download Center recommends.
Install the SU.
Reboot afterward.
Confirm that no Exchange services were left disabled. Disabled services indicate an interrupted install.

If errors occur, Microsoft points to SetupAssist.

The build number comes from the file version of ExSetup.exe. Franky's Web gives this command:

Get-Command Exsetup.exe | ForEach-Object {$_.FileVersionInfo}

A patched server reports 15.2.2562.57. Run Health Checker again afterward to confirm the patch level and flag any remaining manual steps.

Microsoft lists no separate workaround. NSA guidance recommends keeping the Exchange Emergency Mitigation Service enabled, but explicitly notes it does not replace Exchange Security Updates, and no source documents a mitigation for this CVE through that service.

Versions with no fix

In its November release post, the Exchange team states that Exchange 2016 and 2019 are "no longer tested for vulnerabilities and there are no updates released." The October 2026 SU was the last update for those versions, including for customers in the Period 2 ESU program. Their absence from this advisory does not mean they are unaffected. It means they receive no patch, and the path to the fix is migration to Exchange SE.

A note on the release notes

The November Exchange release notes also mention instability caused by October 2026 Windows Server updates (an RPC Endpoint Mapper limit). The November Windows Server updates fix that issue, not the Exchange SU, and it is unrelated to CVE-2026-118153. Microsoft says the Exchange and Windows updates can be installed in either order.

Affected systems and versions

Microsoft Exchange Server Subscription Edition RTM, x64 systems, from 15.02.0.0 up to but not including 15.02.2562.057 (15.2.2562.57).
Installations requiring the update include Exchange servers in hybrid deployments, Exchange servers used only for management, and servers or workstations running the Exchange Management Tools.
The KB5133453 package lists Windows Server 2019, Windows Server 2022, and Windows Server 2025 as supported operating systems, with actual requirements varying by configuration.
Exchange Server 2016 and 2019 are out of support and receive no fix. Microsoft does not list them in this advisory, and that omission should not be read as confirmation that they are unaffected.
Exchange Online is already protected, according to Microsoft.

Vendor security history

Exchange SE follows Microsoft's Modern Lifecycle Policy and has been In Support since 1 July 2025. Exchange has a well-documented history as a target. In March 2021, Microsoft reported limited, targeted attacks against on-premises Exchange using CVE-2021-26855, CVE-2021-26857, CVE-2021-26858, and CVE-2021-27065, and attributed the campaign with high confidence to HAFNIUM, a group it assessed as state sponsored and operating from China. That campaign enabled mailbox access, web shell deployment, and persistent malware.

That case explains why Exchange patching receives sustained attention, but the situation differs: observed exploitation of code-execution and access flaws by a named actor, against an availability flaw with exploitation marked No. Neither the capabilities nor the attribution transfer to CVE-2026-118153. For this CVE, Microsoft's response consists of an advisory, an official fix, explicit exploitability flags, and acknowledgement of the reporter.

CVE Analysis

Experimental AI-Generated Content

Introduction

Technical information