CVE-2026-77910

Awaiting Analysis Awaiting Analysis - Queue

Incorrect Authorization in Microsoft Exchange Server

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Microsoft Corporation

Description

Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-77910

EUVD

EUVD-2026-100140

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Microsoft	Exchange Server 2016 Cumulative Update 23 15.01.0.0
Microsoft	Microsoft	Exchange Server 2019 Cumulative Update 14 15.02.0.0
Microsoft	Microsoft	Exchange Server 2019 Cumulative Update 15 15.02.0.0
Microsoft	Microsoft	Exchange Server Subscription Edition RTM 15.02.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-863	The product performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check.

Attack-Flow Graph

Executive Summary

This vulnerability is an incorrect authorization issue in Microsoft Exchange Server. An authorized attacker can exploit it over a network to elevate their privileges, gaining higher access than intended.

Impact Analysis

An attacker could gain elevated access to sensitive data or system functions, potentially leading to data breaches, unauthorized modifications, or further network compromise.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements such as GDPR or HIPAA, which mandate strict access controls and data protection.

Mitigation Strategies

Apply the latest security updates from Microsoft for Exchange Server 2016 CU23, 2019 CU14/CU15, or Subscription Edition RTM as soon as possible to address the incorrect authorization issue.

Hi! I’m here to help you understand CVE-2026-77910. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70