CVE-2026-87695: Microsoft Exchange Server 2016 Cumulative Update 23

High severity, CVSS 7.8. EPSS: 0.2% chance of exploitation in the next 30 days.

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Affected products

• Microsoft Microsoft Exchange Server 2016 Cumulative Update 23: from 15.01.0.0, before 15.01.2507.077 (fixed in 15.01.2507.077)
• Microsoft Microsoft Exchange Server 2019 Cumulative Update 14: from 15.02.0.0, before 15.02.1544.050 (fixed in 15.02.1544.050)
• Microsoft Microsoft Exchange Server 2019 Cumulative Update 15: from 15.02.0.0, before 15.02.1748.055 (fixed in 15.02.1748.055)
• Microsoft Microsoft Exchange Server Subscription Edition Rtm: from 15.02.0.0, before 15.02.2562.056 (fixed in 15.02.2562.056)

Published 2026-10-13. Last modified 2026-10-14.