The vulnerability stems from Microsoft Exchange Server processing input from an untrusted control sphere without adequate isolation, allowing an attacker with legitimate access on the local machine to gain elevated privileges. This flaw is categorized as a privilege escalation flaw (CWE‑829) and can enable the attacker to run code with higher privileges on the affected Exchange server, potentially compromising the entire server environment and any connected services. The impact is limited to systems where the attacker already has authorized access but expands that access to perform privileged actions beyond the intended scope.

The flaw affects Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Updates 14 and 15, and the Microsoft Exchange Server Subscription Edition Release‑to‑Market build. Systems running these exact versions without the latest patches are susceptible.

Seventeen Sep 2026 the CVSS base score is 7.8, indicating a high impact. The EPSS score is not available, so the current exploitation likelihood is uncertain, and the vulnerability is not listed in CISA's Known Exploited Vulnerabilities catalog. Exploitation likely requires the attacker to already have authenticated local or remote access to the Exchange server, after which the vulnerability can be leveraged to elevate privileges. The local privilege escalation path is straightforward once an attacker has access, making the threat significant within the scope of affected systems.