An incorrect authorization check in Microsoft Exchange Server allows an attacker who already has legitimate network access to raise privileges, potentially giving them full control over the server. The weakness is an access control failure (CWE-863) that can enable data exfiltration, modification of mail routing, or installation of malware. The CVSS score of 8.8 marks it as a high‑severity flaw.

The vulnerability affects Microsoft Exchange Server 2016 with Cumulative Update 23, Microsoft Exchange Server 2019 with Cumulative Updates 14 and 15, and the Subscription Edition released as RTM. These versions are still deployed in numerous environments.

With a high CVSS score and no available EPSS data, the exploitation risk is moderate to high, largely depending on the presence of valid authenticated users. An attacker with authorized access can exploit the flaw to elevate to system‑level privileges, which is dangerous for confidentiality, integrity, and availability. The vulnerability is not listed in CISA's KEV catalog, but its nature and high severity make it attractive to attackers in environments where legitimate users have sufficient network reach.