{"id":"CVE-2026-69382","aliases":[],"cve":{"records":[{"id":"CVE-2026-69382","source":"microsoft","state":"PUBLISHED","reasons":[],"replacements":[],"disputed":false,"unsupportedWhenAssigned":false,"reserved":"2026-08-03T20:54:04.487Z","published":"2026-09-08T17:12:48.218Z","modified":"2026-11-10T21:31:33.247Z"}],"publishers":[{"name":"microsoft","role":"CNA","organizationId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","modified":"2026-11-10T21:31:33.247Z"},{"name":"CISA-ADP","role":"ADP","organizationId":"134c704f-9b21-4f2e-91b3-4a467353bcc0","modified":"2026-09-08T20:23:10.856Z"}],"references":[{"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69382","tags":["vendor-advisory","patch"],"source":"microsoft"}],"weaknesses":[{"id":"CWE-327","description":"CWE-327: Use of a Broken or Risky Cryptographic Algorithm","source":"microsoft"}],"applicability":[{"source":"microsoft","statements":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_15:*:*:*:*:*:*","versionStartIncluding":"15.02.0.0","versionEndExcluding":"15.02.1748.051"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:exchange_server_2019:*:cumulative_update_14:*:*:*:*:*:*","versionStartIncluding":"15.02.0.0","versionEndExcluding":"15.02.1544.046"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:exchange_server_2016:*:cumulative_update_23:*:*:*:*:*:*","versionStartIncluding":"15.01.0.0","versionEndExcluding":"15.01.2507.073"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:exchange_server_se:*:RTM:*:*:*:*:*:*","versionStartIncluding":"15.02.0.0","versionEndExcluding":"15.02.2562.049"}]}]}]}],"prioritization":[{"source":"CISA-ADP","type":"SSVC","role":"CISA Coordinator","timestamp":"2026-09-08T19:51:03.611637Z","decisions":[{"name":"Exploitation","value":"none"},{"name":"Automatable","value":"no"},{"name":"Technical Impact","value":"partial"}]}]},"title":"Microsoft Exchange Server Information Disclosure Vulnerability","titleSource":"microsoft","descriptionSource":"microsoft","description":"Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.","score":5.9,"severity":"medium","published":"2026-09-08T17:12:48.218Z","modified":"2026-11-10T21:31:33.247Z","withdrawn":false,"knownExploited":false,"affected":[],"products":[{"vendor":"Microsoft","name":"Microsoft Exchange Server 2016 Cumulative Update 23","platforms":["x64-based Systems"],"versions":[{"version":"15.01.0.0","status":"affected","lessThan":"15.01.2507.073","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69382"},{"vendor":"Microsoft","name":"Microsoft Exchange Server 2019 Cumulative Update 14","platforms":["x64-based Systems"],"versions":[{"version":"15.02.0.0","status":"affected","lessThan":"15.02.1544.046","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69382"},{"vendor":"Microsoft","name":"Microsoft Exchange Server 2019 Cumulative Update 15","platforms":["x64-based Systems"],"versions":[{"version":"15.02.0.0","status":"affected","lessThan":"15.02.1748.051","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69382"},{"vendor":"Microsoft","name":"Microsoft Exchange Server Subscription Edition RTM","platforms":["x64-based Systems"],"versions":[{"version":"15.02.0.0","status":"affected","lessThan":"15.02.2562.049","versionType":"custom"}],"cpes":[],"source":"microsoft","url":"https://www.cve.org/CVERecord?id=CVE-2026-69382"}],"remediation":[],"references":["https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69382"],"sources":[{"name":"CVE","id":"CVE-2026-69382","modified":"2026-11-10T21:31:33.247Z","url":"https://www.cve.org/CVERecord?id=CVE-2026-69382"}],"assessments":[{"source":"microsoft","vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","score":5.9}],"sourceAffected":[],"observedAt":"2026-11-11T02:41:18.205Z","kev":{"status":"not-listed","checkedAt":"2026-11-15T03:35:31.150Z"},"coverage":[{"source":"NVD","status":"refresh-failed","attemptedAt":"2026-11-14T12:35:33.378Z"},{"source":"GHSA","status":"available","checkedAt":"2026-11-14T12:20:34.856Z","attemptedAt":"2026-11-14T12:20:34.856Z"},{"source":"EUVD","status":"available","checkedAt":"2026-11-14T12:15:37.176Z","attemptedAt":"2026-11-14T12:15:37.176Z"},{"source":"EPSS","status":"available","checkedAt":"2026-11-14T12:10:35.248Z","attemptedAt":"2026-11-14T12:10:35.248Z"}],"evidence":[{"source":"FIRST EPSS","id":"CVE-2026-69382","url":"https://www.first.org/epss/","probability":0.00471,"percentile":0.41261,"date":"2026-11-13","checkedAt":"2026-11-14T12:10:35.248Z"},{"source":"ENISA EUVD","id":"EUVD-2026-73130","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-73130","modified":"Nov 10, 2026, 9:31:33 PM","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C","checkedAt":"2026-11-14T12:15:37.176Z"},{"source":"GitHub Advisory Database","id":"GHSA-39fx-jcrv-m48p","url":"https://github.com/advisories/GHSA-39fx-jcrv-m48p","modified":"2026-09-08T18:32:36Z","score":5.9,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N","checkedAt":"2026-11-14T12:20:34.856Z"}],"aiSummary":{"text":"Microsoft Exchange Server versions 2016 Cumulative Update 23, 2019 Cumulative Update 14 and 15, and Subscription Edition RTM are affected by a vulnerability that allows an unauthorized attacker to disclose information over a network due to the use of a broken or risky cryptographic algorithm. The affected versions are less than 15.01.2507.073 for 2016, less than 15.02.1544.046 and 15.02.1748.051 for 2019, and less than 15.02.2562.049 for Subscription Edition RTM. An attacker can exploit this vulnerability to disclose information.","model":"@cf/meta/llama-3.3-70b-instruct-fp8-fast","generatedAt":"2026-10-31T03:46:04.999Z","sources":[{"name":"CVE","url":"https://www.cve.org/CVERecord?id=CVE-2026-69382"}]}}