Critical Microsoft Exchange Server Bugs Allow RCE and DoS Attacks

Key Takeaways

• Microsoft has released critical security updates for multiple vulnerabilities impacting Exchange Server.
• The flaws could lead to remote code execution, denial-of-service, and privilege escalation.
• Exchange Server Subscription Edition, 2019, and 2016 are affected.
• A public demonstration of one critical vulnerability at Pwn2Own Berlin underscores the urgency of patching.

Microsoft Exchange Server Under Attack: Critical Flaws Demand Immediate Patching

Microsoft has issued urgent security patches addressing a series of vulnerabilities within its Exchange Server platform. These critical flaws, disclosed as part of the August 2026 Patch Tuesday, expose on-premises Exchange deployments to potential remote code execution (RCE), denial-of-service (DoS), privilege escalation, spoofing, and security feature bypass attacks.

Impacted products include Exchange Server Subscription Edition, Exchange Server 2019, and Exchange Server 2016. Organizations relying on these versions are strongly advised to implement the provided security updates without delay.

High-Impact Privilege Escalation and Remote Code Execution

Among the most concerning vulnerabilities is CVE-2026-62911, a critical elevation-of-privilege flaw with a CVSS score of 8.0. This vulnerability, categorized under CWE-294 (authentication bypass by capture-replay), could allow an attacker with low privileges to escalate their access within the Exchange environment. Exploitation requires user interaction with a malicious request or resource over the network. Security researchers have highlighted this flaw as particularly critical due to its successful demonstration at Pwn2Own Berlin, indicating its practical exploitability.

Successful exploitation of CVE-2026-62911 could enable attackers to bypass authentication mechanisms and gain unauthorized access to Exchange mailboxes. This could include the ability to read emails, send messages, and download attachments. While Microsoft currently lists the exploit code maturity as unproven, its public demonstration necessitates that defenders treat this vulnerability as a high-priority patching issue.

Another significant flaw is CVE-2026-62913, a remote code execution vulnerability scoring 8.8 on the CVSS scale. This heap-based buffer overflow can be exploited over a network by an attacker with low privileges, requiring no user interaction. A successful attack could allow arbitrary code execution on a vulnerable Exchange Server, potentially leading to severe consequences such as mailbox compromise, persistence, lateral movement, data exfiltration, or even ransomware deployment.

Additional Critical Vulnerabilities

Further elevation-of-privilege issues include CVE-2026-62910, which has a CVSS score of 7.2. This flaw stems from improper control of resource identifiers (resource injection). While it requires high privileges for exploitation, the attack is network-based and does not involve user interaction. An authorized threat actor could leverage crafted requests to gain elevated permissions and expand their control over Exchange services, potentially achieving SYSTEM-level access.

Microsoft also addressed CVE-2026-62912, a denial-of-service vulnerability with a CVSS score of 6.5. This issue, caused by the deserialization of untrusted data, can be exploited remotely with low privileges and no user interaction. A successful DoS attack could disrupt the availability of an Exchange Server, impacting email delivery, administrative functions, and critical business communications.

Rounding out the updates are CVE-2026-62914, a cross-site scripting (XSS) spoofing vulnerability, and CVE-2026-62915, a security feature bypass due to missing authorization controls. These vulnerabilities could enable attackers to impersonate trusted content, target Exchange users through malicious web content, or perform unauthorized actions that compromise data integrity within affected environments.

What You Should Do

• Immediately apply Microsoft’s August 2026 security updates for all affected Exchange Server installations.
• Review and audit all privileged accounts within your Exchange environment.
• Monitor Exchange server logs for any unusual authentication attempts or abnormal mailbox access patterns.
• Restrict unnecessary remote administrative access to Exchange servers.
• Organizations utilizing Exchange Online are automatically protected from these server-side vulnerabilities; however, on-premises deployments require immediate action.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.