{"id":"CVE-2018-8581","kind":"vulnerability","aliases":["CVE-2018-8581"],"related":[],"title":"Microsoft Exchange Server: Microsoft Exchange Server Privilege Escalation Vulnerability","description":"A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.\n\nCISA required action: Apply updates per vendor instructions.","summary":"Microsoft Exchange Server has a privilege escalation flaw that lets an attacker impersonate any other user on the Exchange server. It is listed in CISA's Known Exploited Vulnerabilities catalog and is tagged as used in ransomware campaigns.","severity":"high","cvss":7.4,"epss":0.27355,"exploited":true,"exploited_at":"2022-03-03T00:00:00+00:00","products":[{"name":"Microsoft Exchange Server","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exchange-server","exploited","infrastructure","ransomware","self-hosted","windows"],"not_affected_if":["managed-hosting"],"how_to_check":null,"fix":"Apply the Microsoft updates for Exchange Server per vendor instructions, as CISA requires.","status":"open","published_at":"2018-11-14T01:29:01+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:24:31+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:24:31Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft updates for Exchange Server per vendor instructions, as CISA requires.\nunknown","reach":"network","impact":"high","summary":"Microsoft Exchange Server has a privilege escalation flaw that lets an attacker impersonate any other user on the Exchange server. It is listed in CISA's Known Exploited Vulnerabilities catalog and is tagged as used in ransomware campaigns.","category":"infrastructure","who_cares":["exchange-server","windows","self-hosted"],"confidence":0.6,"needs_auth":"yes","worst_case":"Attacker impersonates any mailbox user on the Exchange server","analyst_note":"Find the patched Exchange build numbers and detection steps in Microsoft's advisory for CVE-2018-8581 and the CISA KEV entry at https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8581.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["managed-hosting"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.00049,"input_tokens":2856,"output_tokens":408,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2018':11A,14A '-8581':12A,15A 'action':96C 'appli':97C 'attack':40B,77C 'attempt':84C 'campaign':66B 'catalog':58B 'cisa':53B,94C 'could':83C 'cve':10A,13A 'escal':8A,35B,69C 'exchang':2A,5A,20B,30B,47B,74C,92C 'exchange':17A 'exchange-serv':19B 'exist':71C 'exploit':22B,56B,80C 'flaw':36B 'host':27B 'imperson':41B,86C 'infrastructur':23B 'instruct':101C 'known':55B 'let':38B 'list':51B 'microsoft':1A,4A,16A,29B,73C 'per':99C 'privileg':7A,34B,68C 'ransomwar':24B,65B 'requir':95C 'self':26B 'self-host':25B 'server':3A,6A,18A,21B,31B,48B,75C,93C 'success':79C 'tag':61B 'updat':98C 'use':63B 'user':44B,89C 'vendor':100C 'vulner':9A,57B,70C,82C 'window':28B","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2018-11-14T01:29:01+00:00","kev":{"dateAdded":"2022-03-03","dueDate":"2022-03-17","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Known"},"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2018-8581","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8581","severity":null,"published_at":"2022-03-03T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T19:35:25+00:00","note":null},{"source":"epss","external_id":"CVE-2018-8581","url":"https://api.first.org/data/v1/epss?cve=CVE-2018-8581","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:44+00:00","fetched_at":"2026-10-23T19:13:44+00:00","note":null},{"source":"nvd","external_id":"CVE-2018-8581","url":"https://nvd.nist.gov/vuln/detail/CVE-2018-8581","severity":null,"published_at":"2018-11-14T01:29:01+00:00","modified_at":"2026-06-17T02:05:08+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}