CVE-2026-45583: Microsoft Exchange Server Remote Code Execution Vulnerability

Synopsis

Code injection vulnerability in Microsoft Exchange Server allows an unauthenticated remote attacker to execute arbitrary code on the server, provided the attacker can induce a user interaction step. The vulnerability is reachable over the network, requires no credentials, but does require victim interaction, and successful exploitation gives the attacker full control over confidentiality, integrity, and availability of the affected system. Patched-image rebuilds at versions 15.01.2507.069, 15.02.1544.041, 15.02.1748.046, and 15.02.2562.043 are available on HarborGuard for environments running affected versions.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The attacker must reach the Exchange Server service over the network; there is no requirement for local or physical access.

• AuthenticationNot required

  No credentials are needed; the attacker can interact with the service as an unauthenticated user.

• Victim interactionRequired

  A user on the target system must perform some interaction (such as opening a crafted message or following a link) for the exploit to trigger.

• Attack complexityDetail

  Attack complexity is high, meaning the attacker must satisfy specific conditions or timing constraints beyond simple delivery of a payload, making reliable exploitation harder to achieve.

Blast Radius

• The attacker executes arbitrary code in the context of the Exchange Server process, gaining the ability to read all mail data, attachments, and stored credentials accessible to that process.
• The attacker can write or modify mail items, configuration files, and any data the Exchange process has write access to on the host filesystem or database.
• The attacker can terminate or crash Exchange services, interrupting mail flow and causing denial of service for all users served by that instance.
• With code execution on the server, the attacker can pivot to adjacent internal systems reachable from the Exchange host.