CVE-2026-69355

Awaiting Analysis Awaiting Analysis - Queue

External Control of File Name in Microsoft Exchange Server

Publication date: 2026-09-08

Last updated on: 2026-09-09

Assigner: Microsoft Corporation

Description

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-08

Last Modified

2026-09-09

Generated

2026-09-29

AI Q&A

2026-09-09

EPSS Evaluated

2026-09-27

NVD

CVE-2026-69355

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	exchange_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-73	The product allows user input to control or influence paths or file names that are used in filesystem operations.

Attack-Flow Graph

Executive Summary

This vulnerability in Microsoft Exchange Server allows an authorized attacker to remotely execute code by manipulating file names or paths. It is caused by improper handling of user input, enabling network-based attacks without additional authentication beyond initial access.

Impact Analysis

If exploited, this vulnerability could allow attackers to take control of your Exchange Server, steal data, install malware, or disrupt services. It may lead to unauthorized access to sensitive emails and files stored on the server.

Compliance Impact

This vulnerability could lead to data breaches, violating GDPR and HIPAA requirements for data protection and confidentiality. Organizations may face legal penalties, reputational damage, and loss of compliance certifications if exploited.

Mitigation Strategies

Apply the latest security updates from Microsoft for Exchange Server as soon as possible to patch the vulnerability.

Hi! I’m here to help you understand CVE-2026-69355. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70