high7.8
CVE-2026-55009
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Impact
Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Exchange Server | Versions 2016, 2019 |
| Microsoft | Exchange Server Subscription Edition | before 15.02.2562.045 |
| Microsoft | Microsoft Exchange Server 2016 Cumulative Update 23 | from 15.01.0.0 before 15.01.2507.071 |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 14 | from 15.02.0.0 before 15.02.1544.043 |
| Microsoft | Microsoft Exchange Server 2019 Cumulative Update 15 | from 15.02.0.0 before 15.02.1748.048 |
| Microsoft | Microsoft Exchange Server Subscription Edition RTM | from 15.02.0.0 before 15.02.2562.045 |