The vulnerable weak authentication in Microsoft Exchange Server permits an authenticated attacker to gain elevated privileges across the network. This weakness, identified as CWE‑1390, could allow the attacker to access or modify data, execute privileged operations, or take control of Exchange services. The impact is purely related to privilege escalation; it does not provide remote code execution or denial of service by itself.

Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14, Microsoft Exchange Server 2019 Cumulative Update 15, Microsoft Exchange Server Subscription Edition RTM are affected. Users of these versions should verify which cumulative update applies to their installation.

The CVSS base score of 8.8 indicates a high impact, and the EPSS score of less than 1% suggests a low likelihood of exploitation. The vulnerability originates from weak authentication mechanisms that allow an authorized user to elevate privileges over a network. Exploitation requires an existing authenticated session and may involve compromised credentials or insufficient role isolation. The flaw is not listed in the CISA KEV catalog.