CVE-2026-62910

Think of Microsoft Exchange Server like the front desk and back office for your business email. This bug lets a logged-in attacker “trick” the server when it processes certain network resource addresses, and then gain higher control—like moving from a regular staff badge to an admin badge. That can lead to wider access and disruption if someone already has a valid account.

This matters if you run Microsoft Exchange Server (including Exchange Server Subscription Edition) and your installed build matches one of the affected cumulative updates listed for this CVE. It specifically requires an attacker to already have a valid, authenticated account, and no user action is needed. The risk is primarily if an attacker can reach your Exchange server and get credentials (for example, through a compromised user account), because exploitation depends on authentication.

This is RED because an authenticated attacker could elevate to higher administrative rights, which can quickly turn a stolen or misused account into full server control. While there’s no clear public evidence in the provided sources of active exploitation of this exact CVE, the required conditions (authenticated access) are realistic for real-world attacks against email systems.

Confirm whether you’re affected

1. On the Exchange server, identify your installed version/build for Microsoft Exchange Server.
2. Compare it to the affected list provided for CVE-2026-62910:
   • Microsoft Exchange Server 2016 Cumulative Update 23
   • Microsoft Exchange Server 2019 Cumulative Update 14
   • Microsoft Exchange Server 2019 Cumulative Update 15
   • Microsoft Exchange Server Subscription Edition RTM
   • exchange server subscription edition

Patch to a fixed build

Upgrade to the fixed versions mapped to your current branch:

• Exchange Server 2016 Cumulative Update 23 → fixed in 15.01.2507.072
• Exchange Server 2019 Cumulative Update 14 → fixed in 15.02.1544.044
• Exchange Server 2019 Cumulative Update 15 → fixed in 15.02.1748.049
• Exchange Server Subscription Edition RTM (and subscription edition) → fixed in 15.02.2562.046

Use Microsoft’s MSRC update guide for the exact package and installation steps for your environment (including any prerequisites and reboot expectations).

If you can’t patch immediately (temporary containment)

1. Reduce the chance of credential misuse: confirm all accounts that can sign in to Exchange are legitimate and currently needed.
2. Disable or remove unused accounts and investigate any suspicious login activity.
3. Enforce stronger authentication controls where applicable (so compromised credentials are less likely to succeed).
4. Restrict exposure where you can (only allow access that is required for your business).

After patching

• Validate that Exchange services are healthy.
• Review logs for unusual privilege changes or repeated failed/successful authentication patterns.

KEV / exploit status note

• This CVE is not listed in CISA KEV based on the provided findings.
• The provided sources did not identify public exploit code or dated incident claims specifically for CVE-2026-62910.
• However, the findings indicate a patch-related actor noted as Lazarus group in PULSE; treat patching as urgent for exposed email systems.

CVE-2026-62910 is an elevation of privilege issue in Microsoft Exchange Server where the core mechanism is improper control of resource identifiers (resource injection). An attacker must be authenticated (authorized) to exploit it over the network, and no user interaction is required.

The traffic-light verdict for this issue is RED, reflecting the risk of turning an already-authenticated foothold into higher administrative rights. Based on the provided findings, there is no public exploit code on record, and no clear dated claims of active exploitation were found in the referenced articles. CISA KEV listing was not present for this CVE.

Fixes are available via Microsoft cumulative updates/builds; targeted upgrade versions are provided per affected Exchange branch in the PATCH findings. EPSS is provided as a prediction only (and not relied upon to determine exploitation posture in the public summary).