CVE-2026-55007

Microsoft Exchange Server Remote Code Execution Vulnerability

No known exploitation. EPSS puts it in the 52nd percentile. No fix published yet.

CVSS 3.18.1High EPSS percentile52nd0.7% chance in 30 days CISA KEVNot listedNo confirmed exploitation
No public exploit known FixNone yetNo fix or workaround published

Published 2026-09-08Updated 2026-09-09Sources: CVE.org, NVD

NVD CVE.org

What to do

No fixed build or workaround is published yet. Limit exposure and watch for a patch.

Steps

Written by AI from the record

Check which Microsoft Exchange Server version and cumulative update you are running (e.g., Exchange 2019 CU14, CU15, or Subscription Edition RTM).
If you are on Exchange 2019 Cumulative Update 14, upgrade to 15.02.1748.051.
If you are on Exchange 2019 Cumulative Update 15, upgrade to 15.02.1748.051.
If you are on Exchange Server Subscription Edition RTM, upgrade to 15.02.2562.049.
After updating, verify Exchange services are healthy and follow your normal change-management/rollback plan.

Vendor advisory Usually a quick update

Check it yourselfA free OpenVAS check exists for this CVE. Run it against your hosts.Is your organisation exposed?Request an assessment to establish which checks fit your systems.

What it is

From the CVE record

Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

In plain language

Written by AI from the record

CVE-2026-55007 is a Microsoft Exchange Server bug that can let an attacker remotely run code; if you run Exchange Server 2019 CU14/CU15 or Exchange Server Subscription Edition RTM, you should treat this as urgent and update to the fixed versions.

CVE-2026-55007 is a remote code execution vulnerability in Microsoft Exchange Server caused by a memory-safety issue (double free, CWE-415), reachable over the network without authentication; fixed releases are Exchange 2019 CU14→CU15.02.1544.046, CU15→15.02.1748.051, and Exchange Subscription Edition RTM→15.02.2562.049.

If you're affected

Complete server compromise
Email and customer data theft
Business outage and service disruption
Ransomware follow-on risk

What is it

This vulnerability is like a “crash-and-takeover” flaw in a remote-access service. If a bad actor reaches your Exchange server over the network, they may be able to run code as if they were inside your system. For a business, that can mean unauthorized access to email, possible data theft, and downtime if the server is damaged or taken over.

Who is affected

This matters if your small business runs Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, or Microsoft Exchange Server Subscription Edition RTM. Because the issue is remotely reachable and does not require a user to click anything, internet exposure of Exchange services increases the risk. The main reachability gate is whether an attacker can reach the Exchange network-facing endpoints from outside your network.

How urgent is it

This is a RED issue because it is a remote code execution flaw in Microsoft Exchange Server, which means attackers can potentially take over the server. While there is no KEV listing in CISA and no public exploit code on record, patching is still urgent because the impact of compromise is severe (full control and service disruption).

What to do — in detail

Confirm exposure and version
- Identify your exact Microsoft Exchange Server edition and current cumulative update.
- Also determine whether your Exchange server is reachable from the internet (typical indicators: externally accessible mail/remote client endpoints).
Map your current version to the fixed version
- If you are on Microsoft Exchange Server 2019 Cumulative Update 14, update to the fixed Exchange 2019 CU14 baseline fix: 15.02.1544.046.
- If you are on Microsoft Exchange Server 2019 Cumulative Update 15, update to 15.02.1748.051.
- If you are on Microsoft Exchange Server Subscription Edition RTM, update to 15.02.2562.049.
Upgrade procedure (follow your standard Exchange patch process)
- Take backups/snapshots as appropriate for your environment.
- Apply the Microsoft update(s) that correspond exactly to the fixed version numbers above.
- Reboot/restart services only as instructed by the update guidance.
- Validate Exchange health after patching (services start normally; mail flow and user logins behave as expected).
If you cannot patch immediately (temporary containment)
- Reduce exposure by limiting inbound access to Exchange from the internet to only what you must use.
- If you use firewall or reverse proxy controls, tighten rules to known required sources/ports.
- Monitor Exchange server logs for unusual requests or crashes during the patch window.
- Document the risk decision and patch timeline with your IT provider.
Where to get the official patch information
- Use Microsoft’s security update guide for CVE-2026-55007: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55007
What to monitor after updating
- Successful completion of the update installation.
- Exchange service stability and error rates.
- Any signs of attempted exploitation (unusual spikes in requests to Exchange endpoints).

Technical context

CVE-2026-55007 is a remote code execution vulnerability in Microsoft Exchange Server tied to CWE-415 (double free). The findings indicate it can be reached over the network by an unauthorized attacker without requiring user interaction. KEV is not listed in CISA KEV and there is no public exploit code on record, and EPSS is predicted at 0.7% with a flat trend; however, the overall verdict is RED due to the high impact potential of Exchange server compromise. Exploitation maturity is not confirmed by KEV/news in the provided findings.

This is a general assessment based on public vulnerability data. It does not account for your specific infrastructure — when in doubt, consult a security specialist.

Exploitation

Where each signal puts this CVE on the scale from published to confirmed exploited.

EPSS52nd

CISA KEV

Not in the catalog. CISA has not confirmed exploitation.

Public exploits

No public exploit or proof of concept found in the sources we track.

EPSS

0.7% chance of exploitation activity in the next 30 days, which ranks it in the 52nd percentile of scored CVEs.

Exploit Prediction Scoring System, FIRST.org. A probability, not a confirmation.

Lifecycle

8 events over 16 days, from the signal feeds we watch.

2026-09-24Analysis publishedSeptember's Record Patch Tuesday Had Two Real Zero-Days. ZDI Ranked an Unexploited Exchange Bug Above Both.
2026-09-11OpenVAS check added
2026-09-09Record updatedrecord updated
2026-09-08Publishedweakness classified, att&ck mapped, record updated

Affected products

Microsoftcommercial · US

Technical detail

CVSS 3.1 vector

Open in the CVSS calculator

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Scored 8.1 by NVD.

How it is reached

Attack Vector NetworkExploitable remotely over the network without any special conditions
Attack Complexity HighRequires specific conditions like a race condition or non-default configuration
Privileges Required NoneNo authentication required — anyone can exploit this
User Interaction NoneNo user interaction needed — fully automated exploitation

Scope

Scope UnchangedImpact is limited to the vulnerable component itself

Impact if exploited

Confidentiality HighTotal information disclosure — all data in the component is compromised
Integrity HighTotal loss of integrity — attacker can modify any data in the component
Availability HighTotal denial of service — the component is completely unavailable