CVE-2026-87696

Awaiting Analysis Awaiting Analysis - Queue

Improper Cryptographic Signature Verification in Microsoft Exchange Server

Publication date: 2026-10-13

Last updated on: 2026-10-14

Assigner: Microsoft Corporation

Description

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-13

Last Modified

2026-10-14

Generated

2026-10-19

AI Q&A

2026-10-14

EPSS Evaluated

2026-10-18

NVD

CVE-2026-87696

EUVD

EUVD-2026-100145

Affected Vendors & Products

Vendor	Product	Version / Range
Microsoft	Microsoft	Exchange Server 2016 Cumulative Update 23 15.01.0.0
Microsoft	Microsoft	Exchange Server 2019 Cumulative Update 14 15.02.0.0
Microsoft	Microsoft	Exchange Server 2019 Cumulative Update 15 15.02.0.0
Microsoft	Microsoft	Exchange Server Subscription Edition RTM 15.02.0.0

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-347	The product does not verify, or incorrectly verifies, the cryptographic signature for data.

Attack-Flow Graph

Executive Summary

This vulnerability involves improper verification of cryptographic signatures in Microsoft Exchange Server. An authorized attacker can exploit this flaw to elevate their privileges over a network without needing additional authentication.

Impact Analysis

An attacker could gain elevated access to your Exchange Server, potentially allowing them to read, modify, or delete sensitive emails and data. This could lead to data breaches, unauthorized access to confidential information, and disruption of email services.

Compliance Impact

This vulnerability could lead to unauthorized access or exposure of personal or health data, violating GDPR and HIPAA compliance. Organizations may face legal penalties, fines, and reputational damage if such data is compromised due to this flaw.

Mitigation Strategies

Apply the latest security updates from Microsoft for Exchange Server 2016 CU23, 2019 CU14, 2019 CU15, or Subscription Edition RTM as soon as possible to address the improper cryptographic signature verification.

Hi! I’m here to help you understand CVE-2026-87696. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70