CVE-2026-87695: 
Microsoft Exchange Server SE vulnerability analysis and mitigation

CVE-2026-87695 is a local privilege escalation vulnerability in Microsoft Exchange Server caused by the inclusion of functionality from an untrusted control sphere (CWE-829). It allows an authorized attacker with low-level local access to elevate privileges on the affected system. Affected products include Microsoft Exchange Server 2016 Cumulative Update 23 (versions 15.01.0.0 before 15.01.2507.077), Exchange Server 2019 Cumulative Update 14 (before 15.02.1544.050), Exchange Server 2019 Cumulative Update 15 (before 15.02.1748.055), and Exchange Server Subscription Edition RTM (before 15.02.2562.056). The vulnerability was publicly disclosed on October 13, 2026, as part of Microsoft's monthly security update release. It carries a CVSS v3.1 base score of 7.8 (High) (Microsoft MSRC).

The vulnerability is classified under CWE-829 (Inclusion of Functionality from Untrusted Control Sphere), meaning the Exchange Server application loads or references code or resources from a location that can be influenced by an attacker. The attack vector is local, requiring the attacker to already have authenticated access with low privileges on the Exchange Server host. No user interaction is required, and attack complexity is low, making exploitation straightforward once local access is established. Associated attack patterns include Code Inclusion (CAPEC-175), Local Code Inclusion (CAPEC-251), Remote Code Inclusion (CAPEC-253), and Process Injection (T1055) (Microsoft MSRC).

Successful exploitation grants a low-privileged local attacker elevated permissions on the Exchange Server system, with high impact to confidentiality, integrity, and availability. An attacker could read sensitive email data and configuration secrets, modify system settings or Exchange configurations, and disrupt service availability — all actions typically reserved for higher-privileged accounts. Because Exchange Server often holds sensitive organizational communications and is integrated with Active Directory, privilege escalation on this platform can serve as a stepping stone for broader lateral movement within the enterprise (Microsoft MSRC).

As of the disclosure date (October 13, 2026), there is no evidence of active in-the-wild exploitation and no public proof-of-concept code has been identified. The EPSS score is 0.0, reflecting a currently low probability of exploitation in the near term. The vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog. Exploitation requires an attacker to already possess local, authenticated access with low privileges on the target Exchange Server, which limits the attack surface compared to remote vulnerabilities (Microsoft MSRC).

Microsoft released security patches on October 13, 2026, addressing this vulnerability across all affected Exchange Server versions. Administrators should update to the following fixed builds: Exchange Server 2016 CU23 to version 15.01.2507.077 or later, Exchange Server 2019 CU14 to 15.02.1544.050 or later, Exchange Server 2019 CU15 to 15.02.1748.055 or later, and Exchange Server Subscription Edition RTM to 15.02.2562.056 or later. As interim mitigations, restrict local interactive and remote desktop access to Exchange Server systems to only trusted administrators, and monitor for unusual privilege escalation activity or unexpected local account behavior on Exchange hosts (Microsoft MSRC).

The Zero Day Initiative (ZDI) included CVE-2026-87695 in their October 2026 Security Update Review, noting it as part of Microsoft's monthly Patch Tuesday release (ZDI Blog). No significant independent researcher commentary or broad social media discussion has been identified at this time, consistent with the absence of a public PoC or active exploitation.