CVE-2026-45583: Microsoft Exchange Server RCE Vulnerability

CVE-2026-45583 Overview

CVE-2026-45583 is a code injection vulnerability in Microsoft Exchange Server. The flaw stems from improper control of code generation, classified under [CWE-94]. An unauthorized attacker can execute code over a network when a user performs a required interaction.

The vulnerability impacts confidentiality, integrity, and availability of affected Exchange Server deployments. Exploitation requires high attack complexity and user interaction, which limits opportunistic mass exploitation. Successful attacks allow adversaries to run arbitrary code in the context of the Exchange Server process.

Critical Impact

Successful exploitation lets an unauthenticated attacker execute arbitrary code on Microsoft Exchange Server, exposing mailboxes, credentials, and downstream Active Directory assets to compromise.

Affected Products

• Microsoft Exchange Server (refer to the Microsoft CVE-2026-45583 Advisory for affected build numbers)

Discovery Timeline

• 2026-06-09 - CVE-2026-45583 published to the National Vulnerability Database
• 2026-06-09 - Last updated in NVD database

Technical Details for CVE-2026-45583

Vulnerability Analysis

The vulnerability resides in how Microsoft Exchange Server generates and processes code constructs from network-supplied input. Exchange fails to properly restrict input that influences code generation paths, allowing an attacker to inject instructions that the server later executes. The attack is delivered over the network and does not require prior authentication.

Exploitation requires user interaction, meaning a user must perform an action such as opening a crafted message or clicking a malicious link routed through the Exchange service. The combination of network reachability and lack of authentication makes Exchange-facing perimeters the primary attack surface.

Because Exchange typically runs with elevated privileges and holds sensitive mail, calendar, and directory data, code execution on the server provides access to mailbox contents, service account credentials, and potential pivots into Active Directory.

Root Cause

The root cause is improper neutralization of attacker-controllable input that is incorporated into a generated code construct, mapped to [CWE-94] Improper Control of Generation of Code. Input intended as data is interpreted as executable instructions during processing.

Attack Vector

The attack vector is network-based with high complexity and required user interaction. An attacker crafts payloads that traverse Exchange-exposed protocols and trigger the vulnerable code generation path once a user interacts with the malicious content. No prior credentials are required.

No verified proof-of-concept code is available for CVE-2026-45583. Refer to the Microsoft CVE-2026-45583 Advisory for vendor-supplied technical specifics.

Detection Methods for CVE-2026-45583

Indicators of Compromise

• Unexpected child processes spawned by Exchange worker processes such as w3wp.exe or EdgeTransport.exe
• Outbound network connections from Exchange Server to untrusted external hosts following inbound message delivery
• New or modified files in Exchange virtual directories, including FrontEnd\HttpProxy and ClientAccess paths

Detection Strategies

• Monitor Exchange IIS logs for anomalous POST requests, unusual user-agent strings, and oversized parameter values targeting Outlook Web Access or Exchange Web Services endpoints
• Correlate user interaction events such as message opens or link clicks with subsequent process creation on Exchange servers
• Apply YARA and behavioral rules looking for webshell drops or script interpreters launched from Exchange service accounts

Monitoring Recommendations

• Enable PowerShell script block logging and module logging on all Exchange Servers to capture injected code execution
• Forward Exchange application logs, IIS logs, and Sysmon process telemetry to a centralized analytics platform for cross-host correlation
• Alert on service account logons originating from Exchange servers to other infrastructure, which can indicate post-exploitation lateral movement

How to Mitigate CVE-2026-45583

Immediate Actions Required

• Apply the Microsoft security update referenced in the Microsoft CVE-2026-45583 Advisory to all on-premises Exchange Servers
• Inventory internet-exposed Exchange Servers and prioritize patching of edge and client access roles first
• Review Exchange logs for indicators of prior exploitation before and after patching

Patch Information

Microsoft has published vendor guidance and the corresponding security update through MSRC. Administrators should consult the Microsoft CVE-2026-45583 Advisory for the specific cumulative update or security update required for each Exchange Server version and build.

Workarounds

• Restrict Exchange administrative endpoints and management interfaces to trusted networks using firewall and reverse-proxy rules
• Enforce attachment and link filtering at the mail gateway to reduce the likelihood of user interaction with malicious content
• Run Exchange services with least-privilege accounts and segment Exchange servers from tier-zero Active Directory assets

# Verify installed Exchange security update level
Get-Command Exsetup.exe | ForEach-Object { $_.FileVersionInfo }

# List recent hotfixes applied to the Exchange host
Get-HotFix | Sort-Object InstalledOn -Descending | Select-Object -First 20