{"id":"CVE-2026-118154","kind":"vulnerability","aliases":["CVE-2026-118154"],"related":[],"title":"Microsoft Exchange Server: untrusted input lets an authorized user gain privileges","description":"Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.","summary":"Microsoft Exchange Server trusts input it should not in a security decision, so an attacker with a valid account on the network can elevate privileges. NVD rates it high (CVSS 8.8).","severity":"high","cvss":8.8,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["exchange-server","on-premises","vendor","windows"],"not_affected_if":["exchange-online","no-on-prem-exchange"],"how_to_check":"- Confirm the Exchange Server version in the Exchange admin center or `Get-ExchangeServer` in Exchange Management Shell\n- Check Microsoft's security update guide entry for this CVE for affected builds","fix":null,"status":"open","published_at":"2026-11-10T19:19:37+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","triaged_at":"2026-11-10T19:30:15+00:00","updated_at":"2026-11-10T19:30:15+00:00","category":"vendor","confidence":0.5,"triage":{"at":"2026-11-10T19:30:15Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"network","title":"Microsoft Exchange Server: untrusted input lets an authorized user gain privileges","impact":"high","summary":"Microsoft Exchange Server trusts input it should not in a security decision, so an attacker with a valid account on the network can elevate privileges. NVD rates it high (CVSS 8.8).","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["exchange-server","windows","on-premises"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized user gains higher privileges on the Exchange server","analyst_note":"Find affected Exchange builds and the fixed cumulative update in Microsoft's security update guide for CVE-2026-118154.","how_to_check":"- Confirm the Exchange Server version in the Exchange admin center or `Get-ExchangeServer` in Exchange Management Shell\n- Check Microsoft's security update guide entry for this CVE for affected builds","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["exchange-online","no-on-prem-exchange"],"who_is_affected":"Organisations running on-premises Microsoft Exchange Server where users hold valid accounts on the network. The sources do not list affected builds, so check the vendor advisory for exact ranges. Exchange Online customers are not covered by this entry.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000709,"input_tokens":4504,"output_tokens":517,"severity_before":"high"},"analyst_status":"queued","analyst_note":"Find affected Exchange builds and the fixed cumulative update in Microsoft's security update guide for CVE-2026-118154.","search":"'-118154':14A,17A '-2026':13A,16A '8.8':56B 'account':44B 'allow':69C 'attack':40B,72C 'author':8A,71C 'cve':12A,15A 'cvss':55B 'decis':37B,64C 'elev':49B,74C 'exchang':2A,19B,27B,67C 'exchange-serv':18B 'gain':10A 'high':54B 'input':5A,30B,60C 'let':6A 'microsoft':1A,26B,66C 'network':47B,78C 'nvd':51B 'on-premis':21B 'premis':23B 'privileg':11A,50B,75C 'rate':52B 'relianc':57C 'secur':36B,63C 'server':3A,20B,28B,68C 'trust':29B 'untrust':4A,59C 'user':9A 'valid':43B 'vendor':24B 'window':25B","nicknames":[],"mitigations":[],"who_affected":"Organisations running on-premises Microsoft Exchange Server where users hold valid accounts on the network. The sources do not list affected builds, so check the vendor advisory for exact ranges. Exchange Online customers are not covered by this entry.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["exchangeserver","high","onpremises","vendor","windows"],"campaign_type":null,"search_a":"'-118154':14A,17A '-2026':13A,16A 'author':8A 'cve':12A,15A 'exchang':2A 'gain':10A 'input':5A 'let':6A 'microsoft':1A 'privileg':11A 'server':3A 'untrust':4A 'user':9A","search_b":"'8.8':56B 'account':44B 'attack':40B 'cvss':55B 'decis':37B 'elev':49B 'exchang':19B,27B 'exchange-serv':18B 'high':54B 'input':30B 'microsoft':26B 'network':47B 'nvd':51B 'on-premis':21B 'premis':23B 'privileg':50B 'rate':52B 'secur':36B 'server':20B,28B 'trust':29B 'valid':43B 'vendor':24B 'window':25B","search_c":"'allow':69C 'attack':72C 'author':71C 'decis':64C 'elev':74C 'exchang':67C 'input':60C 'microsoft':66C 'network':78C 'privileg':75C 'relianc':57C 'secur':63C 'server':68C 'untrust':59C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118154","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118154","severity":null,"published_at":"2026-11-10T19:19:37+00:00","modified_at":"2026-11-10T19:19:37+00:00","first_seen_at":"2026-11-10T19:24:49+00:00","fetched_at":"2026-11-10T19:24:49+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}