Nov 2026: Microsoft Exchange Server Elevation of Privilege Vulnerability
CVE-2026-118151 Published on November 10, 2026

Microsoft Exchange Server Elevation of Privilege Vulnerability
External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Vendor Advisory NVD

Vulnerability Analysis

Exploitation:

NONE

Automatable:

Technical Impact:

TOTAL

Weakness Type

External Control of File Name or Path

The software allows user input to control or influence paths or file names that are used in filesystem operations.

Products Associated with CVE-2026-118151

Want to know whenever a new CVE is published for Microsoft Exchange Server Se? stack.watch will email you.

Microsoft Exchange Server Se

Affected Versions

Microsoft Exchange Server Subscription Edition RTM:

Version 15.02.0.0 and below 15.02.2562.057 is affected.

Exploit Probability

EPSS

1.08%

Percentile

65.53%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.