CVE-2026-87692

Awaiting Analysis Awaiting Analysis - Queue

Privilege Escalation via Deserialization in Microsoft Exchange Server

Publication date: 2026-10-13

Last updated on: 2026-10-13

Assigner: Microsoft Corporation

Description

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-13

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-87692

EUVD

EUVD-2026-100143

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Microsoft	Exchange Server 2016 Cumulative Update 23 15.01.0.0
Microsoft	Microsoft	Exchange Server 2019 Cumulative Update 14 15.02.0.0
Microsoft	Microsoft	Exchange Server Subscription Edition RTM 15.02.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-502	The product deserializes untrusted data without sufficiently ensuring that the resulting data will be valid.

Attack-Flow Graph

Executive Summary

This vulnerability involves deserialization of untrusted data in Microsoft Exchange Server. An authorized attacker can exploit this to elevate their privileges locally on the affected system.

Impact Analysis

An attacker with local access could gain higher privileges, potentially allowing them to take control of the Exchange Server, access sensitive data, or perform unauthorized actions.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements for GDPR and HIPAA, which mandate strict data protection and access controls.

Mitigation Strategies

Apply the latest security updates from Microsoft for Exchange Server 2016 CU23, 2019 CU14, or Subscription Edition RTM to address the deserialization flaw.

Hi! I’m here to help you understand CVE-2026-87692. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70