Microsoft Exchange Server Vulnerabilities Enable DoS, Privilege Escalation, and RCE Attacks

HomeCyber Security News Microsoft Exchange Server Vulnerabilities Enable DoS, Privilege Escalation, and RCE Attacks By Abinaya August 13, 2026 Microsoft has released security updates for multiple Exchange Server vulnerabilities that could allow denial-of-service, privilege escalation, remote code execution, spoofing, and security feature bypass attacks. The flaws were disclosed on August 11, 2026, as part of Microsoft’s monthly Patch Tuesday release. Exchange Server Subscription Edition, Exchange Server 2019, and Exchange Server 2016 are among the supported products receiving security updates. The most serious issue is CVE-2026-62911, a critical elevation-of-privileges vulnerability with a CVSS score of 8.0. The flaw is linked to CWE-294, known as authentication bypass by capture-replay. An attacker with low privileges could exploit the issue over a network if they can convince a user to interact with a malicious request or resource. Successful exploitation could allow the attacker to gain higher permissions within the Exchange environment. Security researchers have highlighted CVE-2026-62911 as a major concern because it was demonstrated at Pwn2Own Berlin. Microsoft Exchange Server Vulnerabilities Reports state that exploitation may enable an attacker to bypass authentication protections and access Exchange mailboxes, including the ability to read messages, send emails, and download attachments. Although Microsoft lists exploit code maturity as unproven, the public demonstration means defenders should treat the vulnerability as a high-priority patching issue. Another elevation-of-privilege flaw, CVE-2026-62910, has a CVSS score of 7.2 and is caused by improper control of resource identifiers, also known as resource injection. The vulnerability requires high privileges, but exploitation is network-based and does not require user interaction. A threat actor with authorized access could abuse crafted requests to gain additional permissions and expand control over Exchange services. Affected Vulnerabilities and CVEs: CVE ID Vulnerability type Attack requirements Security impact CVE-2026-62910 Elevation of Privilege Network attack, low complexity, high privileges required, no user interaction An authorized attacker could elevate privileges, potentially gaining SYSTEM-level access CVE-2026-62911 Elevation of Privilege Network attack, low complexity, low privileges required, user interaction required An attacker could bypass authentication controls and elevate privileges in Exchange Server CVE-2026-62912 Denial of Service Network attack, low complexity, low privileges required, no user interaction An attacker could cause Exchange Server service disruption or unavailability CVE-2026-62913 Remote Code Execution Network attack, low complexity, low privileges required, no user interaction An attacker could execute code on a vulnerable Exchange Server, affecting confidentiality, integrity, and availability CVE-2026-62914 Spoofing Network attack, low complexity, low privileges required, user interaction required An attacker could use malicious web content to spoof trusted Exchange-related content or target users CVE-2026-62915 Security Feature Bypass Network attack, low complexity, low privileges required, no user interaction An attacker could bypass authorization checks and perform unauthorized actions affecting data integrity Microsoft also fixed CVE-2026-62912, a denial-of-service vulnerability caused by deserialization of untrusted data. The flaw has a CVSS score of 6.5 and requires low privileges to exploit. An attacker could exploit it remotely without user interaction to disrupt the availability of an Exchange Server. While it does not directly affect confidentiality or integrity, a successful attack could interrupt email delivery, administrative operations, and business communications. CVE-2026-62913 is a remote code execution vulnerability with a CVSS score of 8.8. The issue involves a heap-based buffer overflow and can be exploited over a network by an attacker with low privileges. No user interaction is required. If exploited successfully, the flaw could allow an attacker to run code on a vulnerable Exchange Server, potentially leading to mailbox theft, persistence, lateral movement, data theft, or ransomware deployment. The update also addresses CVE-2026-62914, a cross-site scripting spoofing vulnerability, and CVE-2026-62915, a security feature bypass caused by missing authorization controls. These issues could help attackers impersonate trusted content, target Exchange users, or make unauthorized changes in affected environments. Organizations should install Microsoft’s August 2026 Exchange Server security updates as soon as possible. Administrators should also review privileged accounts, monitor Exchange logs for abnormal authentication activity, investigate unusual mailbox access, and restrict unnecessary remote administrative access. Exchange Online customers are already protected from these server-side flaws. However, organizations operating on-premises Exchange Server or Exchange management tools should apply the relevant updates without delay.  Strengthen Your SOC by Accelerating Threat Detection & Rapid Investigations. -> Integrate ANY.RUN With Your SOC Now. Tags cyber security cyber security news vulnerability Copy URL Linkedin Twitter ReddIt Telegram Abinayahttps://cybersecuritynews.com/ Abi is a Security Editor and fellow reporter with Cyber Security News. She is covering various cyber security incidents happening in the Cyber Space. Cyber Security Guide Top 10 Malware Threats of the Week – AsyncRAT, Remcos, and Xworm Lead the Surge Three PhaaS Kits Targeting US Organizations to Steal M65 Logins by Bypassing MFA How Top SOCs Detect and Stop AI Phishing that Beats Email Gateways  Top 10 Phishing Kits Used by Hackers to Launch Cyberattacks (July 20-26, 2026) An SOC Story of Why Fast Answers Beat Perfect Answers in Cyber Incident Response  Latest Cyber News Cyber Security Trezor ShipMonk Data Breach Exposes Personal Data of Over 13,000 Hardware Wallet Customers Cyber Security News North Korean IT Workers Use AI-Forged IDs and Remote Desktops to Become Trusted Employees Cyber Security News CISA Warns of Windows Ancillary Function 0-Day Vulnerability Exploited in Attacks Cyber Security News GitLab 19.2.2 Patches 13 Security Flaws, Including High-Severity XSS and CI/CD Authorization Flaws Cyber Security News Jewelbug APT Hijacks Browsers to Steal Cookies and Spy on Government Networks Expert Talks Expert Talks From Reactive Forensics to Predictive Defence: Strengthening Cyber Resilience in Banking  Expert Talks Beyond the Lure: What the DoNot Campaign Reveals About Modern Cyber Espionage  Expert Talks Your Incident Response Plan Has a Dependency You Never Approved Expert Talks Security in the AI Era Starts with First Principles  Cyber Security News Planning Your AI Security – How will You Manage All Your Resources?