CVE-2026-62913

Think of Microsoft Exchange Server as the “front door and mail room” for your email system. This bug lets someone who already has login access break out of the normal software behavior and run their own code on the Exchange server from the network. If it’s reachable and someone gains the required access, the result can be a full compromise of the server and disruption of your email.

This matters to you if you run Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, or Microsoft Exchange Server Subscription Edition RTM (including Exchange server subscription edition).

Because this requires an authenticated attacker, the risk is mainly about whether someone can obtain valid login credentials and then reach the Exchange server over the network. As a practical gate: the threat is relevant when your Exchange server is network-reachable and an attacker can get the necessary authenticated access (even if they can’t do anything without that login).

This should be treated as RED because the vulnerability is remote code execution, and the attack can be triggered by an attacker who has valid login access and network reachability. Even though the provided material does not report active exploitation specifically for CVE-2026-62913, the actor attention (notably Lazarus group) and the impact of server code execution make it urgent to patch.

Act now to remove the known vulnerable software states by moving to the Microsoft-fixed builds for your Exchange version.

1. Inventory and confirm exposure

   • Identify which Exchange product/version you run: Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14/15, or Microsoft Exchange Server Subscription Edition RTM.
   • Determine the exact installed build number on the affected Exchange server(s) (so you can compare it to the fixed build list).

2. Determine if you’re on an affected build

   • Treat the following as the key exposure points from Microsoft’s fix list:
     • Exchange 2016 CU23: fixed in 15.01.2507.072
     • Exchange 2019 CU14: fixed in 15.02.1544.044
     • Exchange 2019 CU15: fixed in 15.02.1748.049
     • Exchange Subscription Edition RTM/Subscription Edition: fixed in 15.02.2562.046
   • If your current build is earlier than the fixed build for your line, you should assume you are exposed.

3. Patch to the fixed build (primary remediation)

   • Download and apply the Microsoft Exchange update corresponding to CVE-2026-62913 from the Microsoft MSRC update guide.
   • Upgrade each Exchange server to the fixed build that matches its product line (from the list above).

4. If you cannot patch immediately (temporary containment)

   • Reduce who can reach Exchange over the network (restrict at firewalls/load balancers to only necessary sources).
   • Tighten authentication controls for Exchange logins (for example, reduce exposed accounts, enforce stronger login protections, and ensure you can rapidly detect suspicious login behavior).

5. Validate after patching

   • Confirm the Exchange server now reports the fixed build number.
   • Review Exchange and Windows event logs around the patch window and check for suspicious activity patterns (new service creation, unusual process execution by Exchange-related components, repeated failed/successful logins).

6. Track guidance and due dates

   • No CISA KEV listing was provided for CVE-2026-62913 in the findings, so follow Microsoft’s remediation instructions and your organization’s change-management timeline.

7. What to monitor going forward

   • Monitor for new authenticated sessions, abnormal mailbox access patterns, and any signs of server-side execution changes after the patch rollout.

Severity and nature: CVE-2026-62913 is a remote code execution issue (CWE-122) in Microsoft Exchange Server, using a network-triggerable memory corruption condition. The findings indicate an attacker needs low authentication and no user interaction, meaning exploitation can proceed after obtaining valid login credentials.

Attack mechanism: An authenticated attacker can exploit a memory flaw in Exchange to run arbitrary code on the remote server (heap/memory corruption leading to code execution).

Exploitation status: No CISA KEV entry was provided, and the provided press material does not attribute active exploitation to CVE-2026-62913 (it discusses other issues as exploited in the wild). No public exploit code was found in the provided findings.

Fix availability: Microsoft has published fixed builds for multiple Exchange lines, including Exchange 2016 CU23 (fixed in 15.01.2507.072), Exchange 2019 CU14 (15.02.1544.044), Exchange 2019 CU15 (15.02.1748.049), and Exchange Subscription Edition RTM/Subscription Edition (15.02.2562.046).

EPSS: A prediction was provided (0.6%) with a flat trend; however, exploitation confirmation was not provided in the findings, so treat this as likelihood guidance rather than evidence.

Actor attention: The findings note new patch attention and an actor of Lazarus group; this increases the need to patch quickly despite no specific CVE-2026-62913 exploitation claim in the provided articles.

Practical reachability gate (from the findings): exploitation requires network access to the Exchange server and authenticated user privileges.