CVE-2026-62910
Analyzed Analyzed - Analysis Complete

Improper Resource Injection in Microsoft Exchange Server

Publication date: 2026-08-11

Last updated on: 2026-08-14

Assigner: Microsoft Corporation

Description
Improper control of resource identifiers ('resource injection') in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-11
Last Modified
2026-08-14
Generated
2026-09-01
AI Q&A
2026-08-12
EPSS Evaluated
2026-08-30
NVD
CVE-2026-62910
EUVD
EUVD-2026-56413

Affected Vendors & Products

Showing 38 associated CPEs
Vendor Product Version / Range
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2019
microsoft exchange_server 2016
microsoft exchange_server 2019
microsoft exchange_server 2016
microsoft exchange_server 2019
microsoft exchange_server 2019
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2019
microsoft exchange_server 2019
microsoft exchange_server 2019
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2019
microsoft exchange_server 2016
microsoft exchange_server 2019
microsoft exchange_server 2016
microsoft exchange_server 2016
microsoft exchange_server 2019
microsoft exchange_server 2016
microsoft exchange_server 2019
microsoft exchange_server 2016
microsoft exchange_server 2019
microsoft exchange_server 2019
microsoft exchange_server 2019
microsoft exchange_server_subscription_edition to 15.02.2562.046 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-99 The product receives input from an upstream component, but it does not restrict or incorrectly restricts the input before it is used as an identifier for a resource that may be outside the intended sphere of control.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves improper control of resource identifiers in Microsoft Exchange Server, allowing an authorized attacker to elevate privileges over a network through resource injection.

Impact Analysis

An attacker could gain higher privileges, potentially allowing unauthorized access to sensitive data or system functions in Microsoft Exchange Server.

Compliance Impact

This vulnerability allows unauthorized privilege escalation in Microsoft Exchange Server, which could lead to unauthorized access to sensitive data. This may violate compliance requirements under GDPR (data protection) and HIPAA (health information security) by enabling unauthorized data exposure or modification.

Mitigation Strategies

Apply the latest security updates from Microsoft for Exchange Server as soon as possible to address the improper resource identifier control.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-62910. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart