---
id: "CVE-2026-118207"
page: "https://infrastack.ai/live/CVE-2026-118207"
kind: "vulnerability"
aliases: ["CVE-2026-118207"]
title: "Microsoft Exchange Server SE: input validation flaw lets a logged-in user run code (fixed in SU12)"
severity: "high"
cvss: 8.8
epss: null
exploited: false
status: "open"
category: "runtime"
products: [{"name": "Microsoft Exchange Server", "fixed": [], "affected": "", "ecosystem": "vendor"}, {"name": "Microsoft Exchange Server Subscription Edition RTM", "fixed": ["15.02.2562.057 (SU12, KB5133453)"], "affected": ">= 15.02.0.0, < 15.02.2562.057", "ecosystem": "vendor"}]
ecosystems: ["vendor"]
tags: ["auth-required", "exchange-server", "on-premises", "runtime", "windows"]
not_affected_if: ["exchange-online", "managed-hosting"]
published_at: "2026-11-10T19:19:37+00:00"
first_seen_at: "2026-11-10T19:24:50+00:00"
updated_at: "2026-11-10T23:21:07+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-118207", "first_seen_at": "2026-11-10T19:24:50+00:00"}, {"source": "analyst", "url": "https://app.opencve.io/cve/CVE-2026-118207", "first_seen_at": "2026-11-10T23:21:07+00:00", "cites": ["https://app.opencve.io/cve/CVE-2026-118207", "https://support.microsoft.com/help/5133453"]}]
exploit_sources: []
---

# Microsoft Exchange Server SE: input validation flaw lets a logged-in user run code (fixed in SU12)

Link for people: https://infrastack.ai/live/CVE-2026-118207 (this .md is for agents)

Microsoft Exchange Server does not properly validate some input, so a user who already has an account can run code on the server over the network. The sources give no further detail on the affected code path or versions.

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Exchange Server affected range not listed fixed no fixed version listed
- vendor:Microsoft Exchange Server Subscription Edition RTM affected >= 15.02.0.0, < 15.02.2562.057 fixed 15.02.2562.057 (SU12, KB5133453)

## How to check

In Exchange Management Shell run: Get-ExchangeServer | Format-List Name,AdminDisplayVersion. Builds of Exchange SE RTM below 15.02.2562.057 (per the CVE record's version data) are affected; SU12 is 15.2.2562.57. Run the Exchange Health Checker to confirm.

## Fix

Install the November 2026 Exchange Server Subscription Edition RTM security update SU12, KB5133453 (ExchangeSubscriptionEdition-KB5133453-x64-en.exe), which lists CVE-2026-118207 as resolved. Restart is required.

## Timeline

- 2026-11-10T19:24:50+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-118207
- 2026-11-10T23:21:07+00:00 analyst https://app.opencve.io/cve/CVE-2026-118207 — Fix verified on Microsoft KB5133453 page; affected range from CVE record mirrors (OpenCVE), MSRC page is JS-only and was not readable. Not exploited per KB/KEV; Automox says Exploitation More Likely (secondary, unverified).

## Documents

- [describes] OpenCVE: CVE-2026-118207 (CNA version data) https://app.opencve.io/cve/CVE-2026-118207
- [fix] KB5133453 Exchange SE RTM SU12 https://support.microsoft.com/help/5133453

## From the sources

Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_