Nov 2026: Microsoft Exchange Server Remote Code Execution Vulnerability
CVE-2026-118207 Published on November 10, 2026

Microsoft Exchange Server Remote Code Execution Vulnerability
Improper input validation in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

Vendor Advisory NVD

Vulnerability Analysis

Exploitation:
NONE
Automatable:
NO
Technical Impact:
TOTAL

Weakness Type

Use of Incorrectly-Resolved Name or Reference

The software uses a name or reference to access a resource, but the name/reference resolves to a resource that is outside of the intended control sphere.


Products Associated with CVE-2026-118207

Want to know whenever a new CVE is published for Microsoft Exchange Server Se? stack.watch will email you.

Microsoft Exchange Server Se

Affected Versions

Microsoft Exchange Server Subscription Edition RTM:

Exploit Probability

EPSS
1.15%
Percentile
67.27%

EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.