{"id":"CVE-2026-118208","kind":"vulnerability","aliases":["CVE-2026-118208"],"related":[],"title":"Microsoft Exchange Server: access control flaw lets an authorized user spoof","description":"Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.","summary":"Improper access control in Exchange Server Subscription Edition lets an authenticated low-privilege user perform spoofing over the network (CVSS 7.1: high integrity impact, low availability impact, no confidentiality impact). Microsoft's record does not say which messages or identities can be forged.","severity":"high","cvss":7.1,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Exchange Server Subscription Edition","fixed":["15.02.2562.057"],"affected":">= 15.02.0.0, < 15.02.2562.057","ecosystem":"vendor"}],"ecosystems":[],"tags":["authenticated","exchange-server","microsoft","on-premises-email","self-hosted","vendor"],"not_affected_if":["exchange-online","managed-hosting"],"how_to_check":"On each Exchange SE server run in Exchange Management Shell: Get-ExchangeServer | Format-List Name,AdminDisplayVersion. Exposed if the build is below 15.02.2562.057 (per the Microsoft CNA data in NVD).","fix":"Install the Exchange SE update that brings the build to 15.02.2562.057 or later; the exact KB/update name is unknown until MSRC's page is read.","status":"open","published_at":"2026-11-10T19:19:37+00:00","first_seen_at":"2026-11-10T19:24:50+00:00","triaged_at":"2026-11-10T19:47:57+00:00","updated_at":"2026-11-10T23:21:20+00:00","category":"vendor","confidence":0.6,"triage":{"at":"2026-11-10T19:47:57Z","model":"claude-haiku-5-5","output":{"fix":"- unknown","reach":"network","title":"Microsoft Exchange Server: access control flaw lets an authorized user spoof","impact":"medium","summary":"An improper access control flaw in Microsoft Exchange Server lets a user who already has an account perform spoofing over the network. The sources do not say which messages or identities can be forged or how much data is exposed.","audience":"businesses","category":"vendor","nicknames":[],"who_cares":["exchange-server","microsoft","on-premises-email"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"authorized user spoofs identities or messages on the server","analyst_note":"Check Microsoft's CVE-2026-118208 advisory for affected Exchange builds, the fixed build or update, and what the spoofing exposes.","how_to_check":"- unknown","plain_action":"","product_name":"","needs_analyst":true,"not_affected_if":["exchange-online"],"who_is_affected":"Organizations that run Microsoft Exchange Server on-premises and have authenticated users on it. The sources do not list affected versions or configurations.","user_interaction":"unknown","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000667,"input_tokens":4488,"output_tokens":437,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check Microsoft's CVE-2026-118208 advisory for affected Exchange builds, the fixed build or update, and what the spoofing exposes.","search":"'-118208':14A,17A '-2026':13A,16A '7.1':57B 'access':4A,37B,81C 'allow':87C 'attack':90C 'authent':23B,46B 'author':9A,89C 'avail':62B 'confidenti':65B 'control':5A,38B,82C 'cve':12A,15A 'cvss':56B 'edit':43B 'edition':22A 'email':31B 'exchang':2A,25B,40B,85C 'exchange':19A 'exchange-serv':24B 'flaw':6A 'forg':79B 'high':58B 'host':34B 'ident':76B 'impact':60B,63B,66B 'improp':36B,80C 'integr':59B 'let':7A,44B 'low':48B,61B 'low-privileg':47B 'messag':74B 'microsoft':1A,18A,27B,67B,84C 'network':55B,96C 'on-premises-email':28B 'perform':51B,92C 'premis':30B 'privileg':49B 'record':69B 'say':72B 'self':33B 'self-host':32B 'server':3A,20A,26B,41B,86C 'spoof':11A,52B,93C 'subscript':42B 'subscription':21A 'user':10A,50B 'vendor':35B","nicknames":[],"mitigations":[],"who_affected":"Organizations running self-hosted Exchange Server Subscription Edition below build 15.02.2562.057. The attacker needs a valid account on the server. Exchange Online customers are not named in the record.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["exchangeserversubscriptionedition","microsoftexchangeserversubscriptionedition"],"ptokens":["edition","exchange","microsoft","server","subscription"],"labels":["authenticated","exchangeserver","high","microsoft","onpremisesemail","selfhosted","vendor"],"campaign_type":null,"search_a":"'-118208':14A,17A '-2026':13A,16A 'access':4A 'author':9A 'control':5A 'cve':12A,15A 'edition':22A 'exchang':2A 'exchange':19A 'flaw':6A 'let':7A 'microsoft':1A,18A 'server':3A,20A 'spoof':11A 'subscription':21A 'user':10A","search_b":"'7.1':57B 'access':37B 'authent':23B,46B 'avail':62B 'confidenti':65B 'control':38B 'cvss':56B 'edit':43B 'email':31B 'exchang':25B,40B 'exchange-serv':24B 'forg':79B 'high':58B 'host':34B 'ident':76B 'impact':60B,63B,66B 'improp':36B 'integr':59B 'let':44B 'low':48B,61B 'low-privileg':47B 'messag':74B 'microsoft':27B,67B 'network':55B 'on-premises-email':28B 'perform':51B 'premis':30B 'privileg':49B 'record':69B 'say':72B 'self':33B 'self-host':32B 'server':26B,41B 'spoof':52B 'subscript':42B 'user':50B 'vendor':35B","search_c":"'access':81C 'allow':87C 'attack':90C 'author':89C 'control':82C 'exchang':85C 'improp':80C 'microsoft':84C 'network':96C 'perform':92C 'server':86C 'spoof':93C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-10T19:19:37+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-118208","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118208","severity":null,"published_at":"2026-11-10T19:19:37+00:00","modified_at":"2026-11-10T19:19:37+00:00","first_seen_at":"2026-11-10T19:24:50+00:00","fetched_at":"2026-11-10T19:24:50+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-118208:3151","url":"https://nvd.nist.gov/vuln/detail/cve-2026-118208","severity":null,"published_at":"2026-11-10T23:21:20+00:00","modified_at":"2026-11-10T23:21:20+00:00","first_seen_at":"2026-11-10T23:21:20+00:00","fetched_at":"2026-11-10T23:21:20+00:00","note":"Read NVD record carrying Microsoft CNA data (MSRC page is JS-only, unreadable). Affects Exchange SE RTM below 15.02.2562.057; CVSS 7.1; not in KEV, no exploitation/PoC found. KB/SU name not confirmed; nothing marked verified.","cites":["https://nvd.nist.gov/vuln/detail/cve-2026-118208","https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118208"]}],"documents":[{"id":120110,"url":"https://nvd.nist.gov/vuln/detail/cve-2026-118208","title":"NVD CVE-2026-118208 (Microsoft CNA data)","kind":"advisory","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":120111,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118208","title":"MSRC Security Update Guide CVE-2026-118208 (JS-only, not readable)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null}],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}