CVE-2026-87692: 
Microsoft Exchange Server SE vulnerability analysis and mitigation

CVE-2026-87692 is a deserialization of untrusted data vulnerability in Microsoft Exchange Server that allows an authenticated local attacker to elevate privileges. It was published on October 13, 2026, as part of Microsoft's October 2026 Patch Tuesday security update cycle. Affected products include Microsoft Exchange Server 2016 Cumulative Update 23 (versions before 15.01.2507.077), Exchange Server 2019 Cumulative Update 14 (versions before 15.02.1544.050), and Exchange Server Subscription Edition RTM (versions before 15.02.2562.056). The vulnerability carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC).

The root cause is improper deserialization of untrusted data (CWE-502), mapped to CAPEC-586 (Object Injection). An attacker with low-privileged local access can supply crafted serialized data to a vulnerable Exchange Server component, which — when deserialized — triggers arbitrary code execution in a higher-privilege context. The attack vector is local, requires low privileges, no user interaction, and has low attack complexity, making it straightforward to exploit once local access is obtained. No public proof-of-concept code has been identified at the time of disclosure (Microsoft MSRC).

Successful exploitation allows an authenticated local user with low privileges to execute arbitrary code and escalate to higher privilege levels on the affected Exchange Server system, resulting in high confidentiality, integrity, and availability impact. An attacker who achieves privilege escalation on an Exchange Server could access sensitive email data, manipulate mail flow configurations, or use the elevated access as a foothold for lateral movement within the organization's network. The scope is limited to the affected system (unchanged scope), but Exchange Servers typically hold highly sensitive organizational communications (Microsoft MSRC).

As of the disclosure date (October 13, 2026), there is no evidence of active in-the-wild exploitation and no public proof-of-concept exploit has been identified. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. Exploitation requires local authenticated access, which limits the attack surface compared to network-exploitable vulnerabilities (Microsoft MSRC).

Microsoft has released security updates addressing this vulnerability for all affected Exchange Server versions. Administrators should apply the following patches: Exchange Server 2016 CU23 update to build 15.01.2507.077 or later, Exchange Server 2019 CU14 update to build 15.02.1544.050 or later, and Exchange Server Subscription Edition update to build 15.02.2562.056 or later. As a compensating control, restrict local interactive and remote desktop access to Exchange Server systems to only authorized administrators, and monitor for suspicious deserialization activity or unexpected privilege escalation events on Exchange hosts (Microsoft MSRC).

The Zero Day Initiative (ZDI) covered this vulnerability as part of their October 2026 Security Update Review, noting it among the Exchange Server issues addressed in Microsoft's Patch Tuesday release (ZDI Blog). No significant broader community or social media discussion has been identified beyond standard Patch Tuesday coverage.