Microsoft Exchange Server Vulnerabilities Enable DoS, Privilege Escalation, and RCE Attacks
Brief
Microsoft has released security updates for multiple Exchange Server vulnerabilities that could allow denial-of-service, privilege escalation, remote code execution, spoofing, and security feature bypass attacks.
The flaws were disclosed on August 11, 2026, as part of Microsoft’s monthly Patch Tuesday release . Exchange Server Subscription Edition, Exchange Server 2019, and Exchange Server 2016 are among the supported products receiving security updates.
The most serious issue is CVE-2026-62911, a critical elevation-of-privileges vulnerability with a CVSS score of 8.
- The flaw is linked to CWE-294, known as authentication bypass by capture-replay.
An attacker with low privileges could exploit the issue over a network if they can convince a user to interact with a malicious request or resource.