{"id":"CVE-2026-118153","kind":"vulnerability","aliases":["CVE-2026-118153"],"related":[],"title":"Microsoft Exchange Server Subscription Edition: unauthenticated network denial of service (fixed in 15.02.2562.057)","description":"Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.","summary":"Microsoft Exchange Server has an inefficient algorithm that an unauthorized attacker can trigger over the network. The result is a denial of service, taking the mail server offline or degrading it.","severity":"high","cvss":7.5,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Exchange Server Subscription Edition RTM","fixed":["15.02.2562.057"],"affected":">= 15.02.0.0, < 15.02.2562.057","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exchange-server","infrastructure","self-hosted","subscription-edition","windows"],"not_affected_if":["exchange-online"],"how_to_check":"On each Exchange SE server run in Exchange Management Shell: Get-ExchangeServer | Format-List Name,AdminDisplayVersion. Exposed if the build is below 15.02.2562.057.","fix":"Update Exchange Server Subscription Edition RTM to build 15.02.2562.057 or later (November 2026 security update); see the MSRC entry for the KB.","status":"open","published_at":"2026-11-10T19:19:37+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","triaged_at":"2026-11-10T19:44:42+00:00","updated_at":"2026-11-10T23:22:17+00:00","category":"infrastructure","confidence":0.8,"triage":{"at":"2026-11-10T19:44:42Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Exchange Server: inefficient algorithm lets an attacker crash mail service","impact":"low","summary":"Microsoft Exchange Server has an inefficient algorithm that an unauthorized attacker can trigger over the network. The result is a denial of service, taking the mail server offline or degrading it.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["exchange-server","self-hosted","windows"],"confidence":0.4,"fix_status":"unknown","needs_auth":"no","worst_case":"Exchange mail service becomes unavailable to legitimate users","analyst_note":"Find affected Exchange versions, the vulnerable component, and the Microsoft security update guide entry for CVE-2026-118153.","how_to_check":"unknown","plain_action":"","product_name":"Microsoft Exchange Server","needs_analyst":true,"not_affected_if":["exchange-online"],"who_is_affected":"Organizations running on-premises Microsoft Exchange Server that accept network traffic from untrusted sources. The sources do not list affected versions or the specific feature involved, so the exposure scope is unknown.","user_interaction":"no","product_ecosystem":"vendor","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000682,"input_tokens":4501,"output_tokens":463,"severity_before":"high"},"analyst_status":"done","analyst_note":"Find affected Exchange versions, the vulnerable component, and the Microsoft security update guide entry for CVE-2026-118153.","search":"'-118153':16A,19A '-2026':15A,18A '15.02.2562.057':13A 'algorithm':43B,68C 'allow':74C 'attack':47B,77C 'complex':69C 'cve':14A,17A 'degrad':66B 'deni':79C 'denial':8A,57B 'edit':5A,35B 'edition':24A 'exchang':2A,27B,38B,72C 'exchange':21A 'exchange-serv':26B 'fix':11A 'host':32B 'ineffici':42B,67C 'infrastructur':29B 'mail':62B 'microsoft':1A,20A,37B,71C 'network':7A,52B,83C 'offlin':64B 'result':54B 'rtm':25A 'self':31B 'self-host':30B 'server':3A,22A,28B,39B,63B,73C 'servic':10A,59B,80C 'subscript':4A,34B 'subscription':23A 'subscription-edit':33B 'take':60B 'trigger':49B 'unauthent':6A 'unauthor':46B,76C 'window':36B","nicknames":[],"mitigations":[],"who_affected":"On-premises Exchange Server Subscription Edition RTM servers (x64) with build 15.02.0.0 up to but below 15.02.2562.057 that accept network traffic from untrusted sources. An unauthenticated attacker can cause denial of service. Exchange Online is not listed as affected. Older Exchange versions are not listed in Microsoft's record; check the MSRC entry.","tier":"B","verified":{"products":{"at":"2026-11-10T23:22:17Z","by":"analyst","doc":"https://cveawg.mitre.org/api/cve/CVE-2026-118153","run_id":3155}},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":["exchangeserversubscriptioneditionrtm","microsoftexchangeserversubscriptioneditionrtm"],"ptokens":["edition","exchange","microsoft","rtm","server","subscription"],"labels":["exchangeserver","high","infrastructure","selfhosted","subscriptionedition","vendor","windows"],"campaign_type":null,"search_a":"'-118153':16A,19A '-2026':15A,18A '15.02.2562.057':13A 'cve':14A,17A 'denial':8A 'edit':5A 'edition':24A 'exchang':2A 'exchange':21A 'fix':11A 'microsoft':1A,20A 'network':7A 'rtm':25A 'server':3A,22A 'servic':10A 'subscript':4A 'subscription':23A 'unauthent':6A","search_b":"'algorithm':43B 'attack':47B 'degrad':66B 'denial':57B 'edit':35B 'exchang':27B,38B 'exchange-serv':26B 'host':32B 'ineffici':42B 'infrastructur':29B 'mail':62B 'microsoft':37B 'network':52B 'offlin':64B 'result':54B 'self':31B 'self-host':30B 'server':28B,39B,63B 'servic':59B 'subscript':34B 'subscription-edit':33B 'take':60B 'trigger':49B 'unauthor':46B 'window':36B","search_c":"'algorithm':68C 'allow':74C 'attack':77C 'complex':69C 'deni':79C 'exchang':72C 'ineffici':67C 'microsoft':71C 'network':83C 'server':73C 'servic':80C 'unauthor':76C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118153","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118153","severity":null,"published_at":"2026-11-10T19:19:37+00:00","modified_at":"2026-11-10T19:19:37+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","fetched_at":"2026-11-10T19:24:49+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118153:3155","url":"https://cveawg.mitre.org/api/cve/CVE-2026-118153","severity":null,"published_at":"2026-11-10T23:22:17+00:00","modified_at":"2026-11-10T23:22:17+00:00","first_seen_at":"2026-11-10T23:22:17+00:00","fetched_at":"2026-11-10T23:22:17+00:00","note":"Microsoft CNA record (cve.org API) gives affected range for Exchange SE RTM; MSRC page is JS-only and unread; KB number only from third-party site, not recorded. No exploitation (CISA SSVC: none).","cites":["https://cveawg.mitre.org/api/cve/CVE-2026-118153"]}],"documents":[{"id":120115,"url":"https://cveawg.mitre.org/api/cve/CVE-2026-118153","title":"CVE record CVE-2026-118153 (Microsoft CNA)","kind":"advisory","source":"analyst","publisher":null,"text":"Microsoft CNA record: Microsoft Exchange Server Denial of Service Vulnerability. Affected: Microsoft Exchange Server Subscription Edition RTM, x64, 15.02.0.0 up to but excluding 15.02.2562.057. CWE-407. CVSS 7.5 AV:N/AC:L/PR:N/UI:N, E:U/RL:O/RC:C. CISA ADP SSVC: Exploitation none, Automatable yes, Technical impact partial. Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118153","published_at":null,"relation":"advisory","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}