CVE-2026-87695: Microsoft Exchange Server Privilege Escalation

CVE-2026-87695 Overview

CVE-2026-87695 is a local privilege escalation vulnerability in Microsoft Exchange Server. The flaw stems from the inclusion of functionality from an untrusted control sphere (CWE-829). An authorized attacker with local access and low privileges can abuse this weakness to elevate privileges on the affected Exchange host.

Exploitation requires no user interaction and yields high impact to confidentiality, integrity, and availability. Microsoft published the advisory in its Security Update Guide.

Critical Impact
A low-privileged, authenticated attacker on an Exchange Server host can obtain elevated privileges, compromising mail flow, mailbox data, and administrative control over the Exchange environment.

Affected Products

Microsoft Exchange Server (specific supported versions as listed in the Microsoft Security Update Guide)

Discovery Timeline

2026-10-13 - CVE-2026-87695 published to NVD
2026-10-14 - Last updated in NVD database

Technical Details for CVE-2026-87695

Vulnerability Analysis

The vulnerability is categorized under [CWE-829]: Inclusion of Functionality from Untrusted Control Sphere. Exchange Server loads or invokes code, components, or configuration sourced from a location that an authorized but low-privileged user can influence. When Exchange processes that externally supplied functionality under a higher-privilege context, the attacker inherits elevated rights.

Because the attack vector is local and requires authentication, an adversary must first gain code execution or shell access on the Exchange host. Common precursors include stolen service account credentials, compromised administrator workstations with remote PowerShell sessions, or chaining with a remote entry-point vulnerability. Successful exploitation grants full read, modify, and disruption capability over Exchange services.

Root Cause

The root cause is improper isolation between trusted Exchange components and resources that reside in a control sphere influenced by lower-privileged users. This typically arises when a privileged process loads libraries, scripts, or configuration from writable paths, or dynamically resolves dependencies without integrity validation. The missing trust boundary allows attacker-controlled functionality to execute inside the privileged Exchange process.

Attack Vector

The adversary authenticates to the Exchange Server host with low privileges, then places or modifies a resource that Exchange will subsequently load. When the privileged Exchange service consumes that resource, the planted functionality executes with elevated rights. The attacker leverages this to add administrative accounts, access mailboxes, or pivot further into Active Directory. No code example is published; refer to the Microsoft Security Update Guide for authoritative technical details.

Detection Methods for CVE-2026-87695

Indicators of Compromise

Unexpected files, DLLs, or scripts appearing in Exchange install paths or in directories referenced by Exchange services.
Exchange worker processes (w3wp.exe, EdgeTransport.exe, Microsoft.Exchange.*) spawning unusual child processes such as cmd.exe, powershell.exe, or rundll32.exe.
New administrative role assignments, mailbox permission grants, or transport rules created outside normal change windows.

Detection Strategies

Monitor module and library loads inside Exchange processes and alert on loads from non-standard or user-writable paths.
Baseline Exchange service account behavior and flag deviations such as interactive logons, lateral SMB access, or LDAP writes to privileged groups.
Correlate local logon events on Exchange hosts with subsequent file writes to Exchange directories to surface staging activity.

Monitoring Recommendations

Enable PowerShell script block logging and module logging on all Exchange servers and forward to a centralized data lake.
Audit filesystem ACLs on Exchange installation directories and alert on permission changes that broaden write access.
Track Exchange cmdlet usage, particularly New-ManagementRoleAssignment, Add-MailboxPermission, and New-TransportRule.

How to Mitigate CVE-2026-87695

Immediate Actions Required

Apply the Microsoft security update referenced in the Microsoft Security Update Guide to all Exchange Server instances.
Restrict interactive and remote PowerShell access to Exchange hosts to a minimal set of tier-0 administrators.
Review and remove unnecessary local accounts and service accounts with logon rights on Exchange servers.

Patch Information

Microsoft has released fixes through its standard security update channel. Administrators should consult the Microsoft Security Update Guide for the exact cumulative update or security update applicable to each supported Exchange Server version and install it on every mailbox and edge transport role in the organization.

Workarounds

Enforce least-privilege ACLs on Exchange installation and configuration directories so only SYSTEM and Exchange-trusted groups retain write access.
Segment Exchange servers on a dedicated management network and block inbound administrative protocols from user subnets.
Require multi-factor authentication for all accounts able to log on to Exchange hosts, including service and break-glass accounts.

bash

# Example: audit non-default write permissions on the Exchange install directory
icacls "C:\Program Files\Microsoft\Exchange Server\V15" /T /C | findstr /I "(W)"

# Example: list recently modified files in Exchange bin to spot planted modules
powershell -Command "Get-ChildItem 'C:\Program Files\Microsoft\Exchange Server\V15\Bin' -Recurse | Where-Object { $_.LastWriteTime -gt (Get-Date).AddDays(-7) } | Select-Object FullName,LastWriteTime"