---
id: "CVE-2018-8581"
kind: "vulnerability"
aliases: ["CVE-2018-8581"]
title: "Microsoft Exchange Server: Microsoft Exchange Server Privilege Escalation Vulnerability"
severity: "high"
cvss: 7.4
epss: 0.27355
exploited: true
status: "open"
category: "infrastructure"
products: [{"name": "Microsoft Exchange Server", "fixed": [], "affected": "", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exchange-server", "exploited", "infrastructure", "ransomware", "self-hosted", "windows"]
not_affected_if: ["managed-hosting"]
published_at: "2018-11-14T01:29:01+00:00"
first_seen_at: "2026-10-23T19:11:52+00:00"
updated_at: "2026-10-23T21:57:35+00:00"
sources: [{"source": "kev", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8581", "first_seen_at": "2026-10-23T19:11:52+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2018-8581", "first_seen_at": "2026-10-23T19:13:44+00:00"}, {"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2018-8581", "first_seen_at": "2026-10-23T21:57:35+00:00"}]
---

# Microsoft Exchange Server: Microsoft Exchange Server Privilege Escalation Vulnerability

Microsoft Exchange Server has a privilege escalation flaw that lets an attacker impersonate any other user on the Exchange server. It is listed in CISA's Known Exploited Vulnerabilities catalog and is tagged as used in ransomware campaigns.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Exchange Server affected ? fixed ?

## Fix

Apply the Microsoft updates for Exchange Server per vendor instructions, as CISA requires.

## Timeline

- 2026-10-23T19:11:52+00:00 kev https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2018-8581
- 2026-10-23T19:13:44+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2018-8581
- 2026-10-23T21:57:35+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2018-8581

## From the sources

A privilege escalation vulnerability exists in Microsoft Exchange Server. An attacker who successfully exploited this vulnerability could attempt to impersonate any other user of the Exchange server.

CISA required action: Apply updates per vendor instructions.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_