---
id: "CVE-2026-118149"
page: "https://infrastack.ai/live/CVE-2026-118149"
kind: "vulnerability"
aliases: ["CVE-2026-118149"]
title: "Microsoft Exchange Server: authorized user can run code over network"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Microsoft Exchange Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Microsoft Exchange Server Subscription Edition RTM", "fixed": ["15.02.2562.057"], "affected": ">= 15.02.0.0, < 15.02.2562.057", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["exchange-server", "on-premises", "on-premises-email", "runtime", "self-hosted", "windows"]
not_affected_if: ["exchange-online", "exchange-online-only", "managed-hosting"]
published_at: "2026-11-10T19:19:36+00:00"
first_seen_at: "2026-11-10T19:24:49+00:00"
updated_at: "2026-11-10T23:23:24+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118149", "first_seen_at": "2026-11-10T19:24:49+00:00"}, {"source": "analyst", "url": "https://nvd.nist.gov/vuln/detail/cve-2026-118149", "first_seen_at": "2026-11-10T23:23:24+00:00", "cites": ["https://nvd.nist.gov/vuln/detail/cve-2026-118149", "https://support.microsoft.com/en-us/servicing/exchange/server/update/2026/5133453"]}]
exploit_sources: []
---

# Microsoft Exchange Server: authorized user can run code over network

Link for people: https://infrastack.ai/live/CVE-2026-118149 (this .md is for agents)

Code injection (CWE-94) in Exchange Server Subscription Edition RTM lets an authenticated low-privilege user run code over the network (CVSS 8.8, no user interaction). Fixed in the November 2026 security update SU12 (KB5133453), build 15.02.2562.057. No exploitation or public PoC found as of 10 Nov 2026.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Exchange Server affected range not listed fixed no fixed version listed
- vendor:Microsoft Exchange Server Subscription Edition RTM affected >= 15.02.0.0, < 15.02.2562.057 fixed 15.02.2562.057

## How to check

In Exchange Management Shell run: Get-ExchangeServer | Format-List Name,AdminDisplayVersion. A build below 15.02.2562.057 is affected. Exchange Health Checker also reports missing security updates.

## Fix

Install Exchange Server SE RTM SU12 (KB5133453, Nov 10 2026), build 15.02.2562.057 or later.

## Timeline

- 2026-11-10T19:24:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118149
- 2026-11-10T23:23:24+00:00 analyst https://nvd.nist.gov/vuln/detail/cve-2026-118149 — MSRC page is JS-only and unreadable here. Affected range and fixed build come from Microsoft's CNA record via NVD. KB5133453 (Microsoft Support) lists the CVE and names SU12 as the package, but does not state the build number. Nothing marked verified. No exploitation or PoC found; not in KEV.

## Documents

- [describes] NVD CVE-2026-118149 (Microsoft CNA data) https://nvd.nist.gov/vuln/detail/cve-2026-118149
- [fix] KB5133453 Exchange Server SE RTM SU12 (Nov 10, 2026) https://support.microsoft.com/en-us/servicing/exchange/server/update/2026/5133453

## From the sources

Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_