CVE-2026-62915

This flaw lets someone who already has an account inside your Exchange environment get around a built-in security guard. Think of it like having a less-privileged key to a building that should only open a storage room—but the lock can be bypassed to change things that weren’t meant to be changed. Because it targets Exchange, attackers may be able to modify important settings or data rather than just view them.

This matters if your business runs Microsoft Exchange Server (including Exchange Server 2016 CU23, Exchange Server 2019 CU14/CU15, or Exchange Server Subscription Edition RTM). It’s reachable over the network, but it requires the attacker to already have valid credentials (an authorized user). The risk is highest if an attacker can obtain or abuse a low-privilege account and then reach the Exchange management/authentication endpoints from the network.

This is RED because the issue is an authorization bypass: an attacker with valid (low-privilege) credentials can bypass Exchange security protections over the network. Even without public exploit code or a confirmed CVE-2026-62915 news incident, the presence of a notable attacker actor tied to this patch and the ability to modify server-side security makes it urgent to remediate.

Confirm exposure

• Identify exactly which product you run:
  • Microsoft Exchange Server 2016 Cumulative Update 23
  • Microsoft Exchange Server 2019 Cumulative Update 14
  • Microsoft Exchange Server 2019 Cumulative Update 15
  • Microsoft Exchange Server Subscription Edition RTM (and “exchange server subscription edition”)
• Confirm your current update level on the server and compare it to the fixed build numbers below.

Upgrade to a fixed version

Upgrade to the fixed build that matches your deployment:

• Exchange Server 2016 Cumulative Update 23 → 15.01.2507.072
• Exchange Server 2019 Cumulative Update 14 → 15.02.1544.044
• Exchange Server 2019 Cumulative Update 15 → 15.02.1748.049
• Exchange Server Subscription Edition RTM / exchange server subscription edition → 15.02.2562.046

Maintenance and verification

• Schedule a maintenance window appropriate for Exchange patching.
• After installing the update, verify:
  • Exchange services are running normally
  • Mail flow and basic user operations work
  • No unexpected configuration changes occurred during the period before patching.

If patching must be delayed

• Reduce the chance an attacker can act with stolen or abused credentials:
  • Tighten access paths to Exchange from the network (only what’s required).
  • Review and restrict low-privilege accounts that can reach Exchange functionality.
  • Increase scrutiny on admin and configuration-change actions.

What to monitor

• Authentication attempts and successful logons for low-privilege accounts.
• Unusual administrative actions or security-setting changes.
• Any errors or abnormal behavior following login from unusual sources.

KEV note

• This CVE is not listed in the CISA KEV feed (so there’s no KEV-driven “confirmed in the wild” indicator in the findings provided).

CVE-2026-62915 is a CWE-862 issue (missing authorization) in Microsoft Exchange Server that allows an authenticated attacker with low privileges to bypass a specific security protection over the network without user interaction. The findings indicate the attacker can disable or circumvent a security protection and that it can modify data (not just cause denial of service). No public exploit code was found in the provided findings, and no clear, dated press reporting specifically mentions exploitation of this exact CVE. The patch information provides fixed build numbers per affected Exchange branch, and Microsoft has published remediation guidance on the MSRC update guide for this CVE. Although KEV is not listed and EPSS is low (and flat per the provided prediction), the verdict is still RED due to the authorization-bypass nature of the flaw and patch-driven attacker interest indicated in the findings.