The vulnerability is an improper input validation flaw in Microsoft Exchange Server that allows an authorized attacker connecting over a network to gain higher privileges than intended. The weakness falls under CWE‑20, resulting in a potential compromise of system integrity where the attacker could execute actions as a privileged user or possibly control the server environment. The problem is not a denial-of-service or data exposure but a privilege escalation that can lead to full system compromise.

Microsoft Exchange Server 2016 with Cumulative Update 23, Microsoft Exchange Server 2019 with Cumulative Updates 14 and 15, and the subscription‑edition rollout on its initial release (RTM). These are the versions explicitly identified by the CNA as affected. Other build numbers listed in the CPE list may be concurrent or superseded by these updates, but the CNA only confirms the above as impacted.

The CVSS score of 7.5 indicates a high severity of the flaw. The EPSS score of <1% suggests that the likelihood of exploitation is low at the time of this analysis. The vulnerability is not currently listed in CISA’s KEV catalog. It presumably requires an authenticated or otherwise authorized attacker within the same network to trigger the flaw, as the description states that an authorized attacker can elevate privileges. Because no public exploit has been reported, the risk is moderate but the potential impact is high enough to warrant prompt remediation.