---
id: "CVE-2026-118154"
page: "https://infrastack.ai/live/CVE-2026-118154"
kind: "vulnerability"
aliases: ["CVE-2026-118154"]
title: "Microsoft Exchange Server Subscription Edition: untrusted input lets an authenticated user gain privileges"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "vendor"
products: [{"name": "Exchange Server Subscription Edition", "fixed": ["15.2.2562.57"], "affected": "RTM < 15.2.2562.57", "ecosystem": "vendor"}]
ecosystems: []
tags: ["exchange-se", "exchange-server", "on-premises", "self-hosted", "vendor", "windows"]
not_affected_if: ["exchange-online", "exchange-online-only", "no-on-prem-exchange"]
published_at: "2026-11-10T19:19:37+00:00"
first_seen_at: "2026-11-10T19:24:49+00:00"
updated_at: "2026-11-10T23:22:29+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118154", "first_seen_at": "2026-11-10T19:24:49+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-118154", "first_seen_at": "2026-11-10T23:22:29+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-118154", "https://techcommunity.microsoft.com/blog/exchange/released-november-2026-exchange-server-security-updates/4570368", "https://ugetfix.com/updates/kb5133453/"]}]
exploit_sources: []
---

# Microsoft Exchange Server Subscription Edition: untrusted input lets an authenticated user gain privileges

Link for people: https://infrastack.ai/live/CVE-2026-118154 (this .md is for agents)

Microsoft Exchange Server trusts input it should not in a security decision, so an attacker with a valid account on the network can elevate privileges. NVD rates it high (CVSS 8.8).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Exchange Server Subscription Edition affected RTM < 15.2.2562.57 fixed 15.2.2562.57

## How to check

In Exchange Management Shell run Get-ExchangeServer | Format-List Name,AdminDisplayVersion and compare with 15.2.2562.57. Or run Microsoft's Exchange Server Health Checker script, which reports servers behind on SUs. Also install the SU on machines that only have Exchange Management Tools.

## Fix

Install the November 2026 Exchange Security Update (KB5133453) on Exchange SE RTM, build 15.2.2562.57 or later. Reboot afterwards and check that the Exchange services start.

## Timeline

- 2026-11-10T19:24:49+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118154
- 2026-11-10T23:22:29+00:00 analyst https://app.opencve.io/cve/CVE-2026-118154 — Microsoft's blog confirms Nov 2026 SU for Exchange SE RTM; the CVE page (MSRC, JS-only) was not readable. Build 15.2.2562.57 comes from CNA data via OpenCVE and KB5133453 from a third party, so nothing is marked verified.

## Documents

- [describes] OpenCVE CVE-2026-118154 (CNA affected range) https://app.opencve.io/cve/CVE-2026-118154
- [fix] Released: November 2026 Exchange Server Security Updates https://techcommunity.microsoft.com/blog/exchange/released-november-2026-exchange-server-security-updates/4570368
- [mentions] KB5133453 (third-party summary) https://ugetfix.com/updates/kb5133453/

## From the sources

Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_