{"id":"CVE-2026-69355","aliases":[],"cve":{"records":[{"id":"CVE-2026-69355","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-03T20:52:08.512Z","published":"2026-09-08T17:12:44.552Z","modified":"2026-10-30T21:51:10.370Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-10-30T21:51:10.370Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-09T10:05:33.485Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69355","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-73","description":"CWE-73: External Control of File Name or Path","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*","versionStartIncluding":"15.02.0.0","versionEndExcluding":"15.02.1748.051"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*","versionStartIncluding":"15.02.0.0","versionEndExcluding":"15.02.1544.046"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*","versionStartIncluding":"15.01.0.0","versionEndExcluding":"15.01.2507.073"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*","versionStartIncluding":"15.02.0.0","versionEndExcluding":"15.02.2562.049"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-09T04:20:20.733059Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"total"}]}]},"title":"Microsoft Exchange Server Remote Code Execution Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.","score":8.8,"severity":"high","published":"2026-09-08T17:12:44.552Z","modified":"2026-10-30T21:51:10.370Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Microsoft Exchange Server 2016 Cumulative Update 23","platforms":["x64-based Systems"],"versions":[{"version":"15.01.0.0","status":"affected","lessThan":"15.01.2507.073","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69355"},{"vendor":"Microsoft","name":"Microsoft Exchange Server 2019 Cumulative Update 14","platforms":["x64-based Systems"],"versions":[{"version":"15.02.0.0","status":"affected","lessThan":"15.02.1544.046","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69355"},{"vendor":"Microsoft","name":"Microsoft Exchange Server 2019 Cumulative Update 15","platforms":["x64-based Systems"],"versions":[{"version":"15.02.0.0","status":"affected","lessThan":"15.02.1748.051","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69355"},{"vendor":"Microsoft","name":"Microsoft Exchange Server Subscription Edition RTM","platforms":["x64-based Systems"],"versions":[{"version":"15.02.0.0","status":"affected","lessThan":"15.02.2562.049","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69355"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69355"],"sources":[{"name":"CVE","id":"CVE-2026-69355","modified":"2026-10-30T21:51:10.370Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-69355"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","score":8.8}],"sourceAffected":[],"observedAt":"2026-10-30T23:33:33.917Z","kev":{"status":"not-listed","checkedAt":"2026-10-31T10:20:31.211Z"},"coverage":[{"source":"NVD","status":"not-checked"},{"source":"GHSA","status":"not-checked"},{"source":"EUVD","status":"not-checked"},{"source":"EPSS","status":"not-checked"}],"evidence":[],"aiSummary":{"text":"Microsoft Exchange Server has a vulnerability that allows an authorized attacker to execute code. The affected versions are Microsoft Exchange Server 2016 Cumulative Update 23, Microsoft Exchange Server 2019 Cumulative Update 14 and 15, and Microsoft Exchange Server Subscription Edition RTM. The weakness is external control of file name or path.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T03:46:04.428Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-69355"}]}}