CVE-2026-87692: Microsoft Exchange Server 2016 Cumulative Update 23

High severity, CVSS 7.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Affected products

• Microsoft Microsoft Exchange Server 2016 Cumulative Update 23: from 15.01.0.0, before 15.01.2507.077 (fixed in 15.01.2507.077)
• Microsoft Microsoft Exchange Server 2019 Cumulative Update 14: from 15.02.0.0, before 15.02.1544.050 (fixed in 15.02.1544.050)
• Microsoft Microsoft Exchange Server Subscription Edition Rtm: from 15.02.0.0, before 15.02.2562.056 (fixed in 15.02.2562.056)

Published 2026-10-13. Last modified 2026-10-13.