The flaw stems from improper verification of a cryptographic signature in Microsoft Exchange Server software. An attacker who is already authorized to access the system over a network can use this oversight to elevate their privileges, potentially granting them broader administrative authority. The flaw is rated with a CVSS score of 7.5, indicating a high severity risk if exploited.

Impact is limited to Microsoft Exchange Server versions that use the specified update set: Exchange Server 2016 with Cumulative Update 23, Exchange Server 2019 with Cumulative Updates 14 and 15, and the Exchange Server Subscription Edition with its RTM release. These are the only documented vulnerable configurations at this time.

Although Microsoft has not reported a current exploit (EPSS is not available) and the vulnerability is not listed in the CISA KEV catalog, the high CVSS score, combined with the fact that an attacker must already have some level of authorized network access, indicates that the risk is significant in environments where privileged users have network reach to Exchange services. The attack vector is thus network‑based and depends on existing credentials, leaving the attack surface narrow yet potentially impactful.