{"id":"CVE-2026-118150","kind":"vulnerability","aliases":["CVE-2026-118150"],"related":[],"title":"Microsoft Exchange Server: authorization bypass lets a signed-in user gain privileges","description":"Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.","summary":"Microsoft Exchange Server has an authorization bypass caused by a user-controlled key, which lets an authorized attacker elevate privileges over the network. The sources give a CVSS score of 8.8 and do not describe exploitation in the wild.","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Exchange Server Subscription Edition RTM","fixed":["15.02.2562.057"],"affected":">= 15.02.0.0, < 15.02.2562.057","ecosystem":"vendor"}],"ecosystems":[],"tags":["exchange-server","on-prem-email","self-hosted","vendor","windows"],"not_affected_if":["exchange-online"],"how_to_check":"Run the Exchange Server Health Checker script (it reports servers behind on SUs), or check the build with Get-ExchangeServer | Format-List Name,AdminDisplayVersion. Exposed if Exchange SE RTM is below 15.02.2562.057.","fix":"Install the November 2026 Exchange SE RTM Security Update SU12 (KB5133453, build 15.02.2562.057). SUs are cumulative; install on all Exchange servers and Management Tools machines, then reboot.","status":"open","published_at":"2026-11-10T19:19:36+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","triaged_at":"2026-11-10T19:30:15+00:00","updated_at":"2026-11-10T23:23:40+00:00","category":"vendor","confidence":0.8,"triage":{"at":"2026-11-10T19:30:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Exchange Server: authorization bypass lets a signed-in user gain privileges","impact":"high","summary":"Microsoft Exchange Server has an authorization bypass caused by a user-controlled key, which lets an authorized attacker elevate privileges over the network. The sources give a CVSS score of 8.8 and do not describe exploitation in the wild.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["exchange-server","on-prem-email","windows"],"confidence":0.6,"fix_status":"unknown","needs_auth":"yes","worst_case":"Authorized user gains elevated privileges on the Exchange server","analyst_note":"Find the Microsoft advisory for CVE-2026-118150 to confirm affected Exchange versions, the fixed builds or cumulative update, and any mitigation.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["exchange-online"],"who_is_affected":"Organizations that run Microsoft Exchange Server on premises, where an authorized account could reach the flawed code over the network. Exchange Online customers are not described as affected by the sources. The sources do not name affected versions or configurations.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000685,"input_tokens":4498,"output_tokens":471,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find the Microsoft advisory for CVE-2026-118150 to confirm affected Exchange versions, the fixed builds or cumulative update, and any mitigation.","search":"'-118150':16A,19A '-2026':15A,18A '8.8':68B 'allow':88C 'attack':55B,91C 'author':4A,42B,54B,77C,90C 'bypass':5A,43B,78C 'caus':44B 'control':49B,82C 'cve':14A,17A 'cvss':65B 'describ':72B 'edition':23A 'elev':56B,93C 'email':31B 'exchang':2A,26B,38B,86C 'exchange':20A 'exchange-serv':25B 'exploit':73B 'gain':12A 'give':63B 'host':34B 'key':50B,83C 'let':6A,52B 'microsoft':1A,37B,85C 'network':60B,97C 'on-prem-email':28B 'prem':30B 'privileg':13A,57B,94C 'rtm':24A 'score':66B 'self':33B 'self-host':32B 'server':3A,21A,27B,39B,87C 'sign':9A 'signed-in':8A 'sourc':62B 'subscription':22A 'user':11A,48B,81C 'user-control':47B,80C 'vendor':35B 'wild':76B 'window':36B","nicknames":[],"mitigations":[],"who_affected":"Self-hosted Exchange Server Subscription Edition RTM servers below build 15.02.2562.057 are affected; an attacker needs a valid low-privilege login and network access. Hybrid organizations must also update on-prem servers, including management-only ones. Exchange Online is already protected. Exchange 2016 and 2019 are out of support: Microsoft does not test or list them and says to treat them as permanently vulnerable.","tier":"B","verified":{"fix":{"at":"2026-11-10T23:23:40Z","by":"analyst","doc":"https://techcommunity.microsoft.com/blog/exchange/released-november-2026-exchange-server-security-updates/4570368","run_id":3157},"who_affected":{"at":"2026-11-10T23:23:40Z","by":"analyst","doc":"https://techcommunity.microsoft.com/blog/exchange/released-november-2026-exchange-server-security-updates/4570368","run_id":3157}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["exchangeserversubscriptioneditionrtm","serversubscriptioneditionrtm"],"ptokens":["edition","exchange","rtm","server","subscription"],"labels":["exchangeserver","high","onprememail","selfhosted","vendor","windows"],"campaign_type":null,"search_a":"'-118150':16A,19A '-2026':15A,18A 'author':4A 'bypass':5A 'cve':14A,17A 'edition':23A 'exchang':2A 'exchange':20A 'gain':12A 'let':6A 'microsoft':1A 'privileg':13A 'rtm':24A 'server':3A,21A 'sign':9A 'signed-in':8A 'subscription':22A 'user':11A","search_b":"'8.8':68B 'attack':55B 'author':42B,54B 'bypass':43B 'caus':44B 'control':49B 'cvss':65B 'describ':72B 'elev':56B 'email':31B 'exchang':26B,38B 'exchange-serv':25B 'exploit':73B 'give':63B 'host':34B 'key':50B 'let':52B 'microsoft':37B 'network':60B 'on-prem-email':28B 'prem':30B 'privileg':57B 'score':66B 'self':33B 'self-host':32B 'server':27B,39B 'sourc':62B 'user':48B 'user-control':47B 'vendor':35B 'wild':76B 'window':36B","search_c":"'allow':88C 'attack':91C 'author':77C,90C 'bypass':78C 'control':82C 'elev':93C 'exchang':86C 'key':83C 'microsoft':85C 'network':97C 'privileg':94C 'server':87C 'user':81C 'user-control':80C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:36+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118150","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118150","severity":null,"published_at":"2026-11-10T19:19:36+00:00","modified_at":"2026-11-10T19:19:36+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","fetched_at":"2026-11-10T19:24:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118150:3157","url":"https://support.microsoft.com/help/5133453","severity":null,"published_at":"2026-11-10T23:23:40+00:00","modified_at":"2026-11-10T23:23:40+00:00","first_seen_at":"2026-11-10T23:23:40+00:00","fetched_at":"2026-11-10T23:23:40+00:00","note":"Fix from MS KB5133453 (SU12) and Exchange team blog; affected range from Microsoft CNA record via NVD. MSRC page is JS-only, not read; no exploitation reported, no workaround in sources. Not verified: how_to_check (my own command), products (build via NVD, not vendor page).","cites":["https://support.microsoft.com/help/5133453","https://techcommunity.microsoft.com/blog/exchange/released-november-2026-exchange-server-security-updates/4570368","https://nvd.nist.gov/vuln/detail/CVE-2026-118150"]}],"documents":[{"id":120108,"url":"https://support.microsoft.com/help/5133453","title":"KB5133453 Exchange SE RTM SU12","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"fix","confidence":null,"note":null},{"id":120114,"url":"https://techcommunity.microsoft.com/blog/exchange/released-november-2026-exchange-server-security-updates/4570368","title":"Released: November 2026 Exchange Server Security Updates","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":120131,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118150","title":"NVD CVE-2026-118150","kind":"other","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}