Affected Systems
Microsoft Exchange Server on-premises: Subscription Edition RTM, Exchange Server 2016 CU23, Exchange Server 2019 CU14 and CU15. Exchange Online already patched server-side; no customer action required.
Exploitation Status
No evidence of active exploitation. Microsoft rates exploitability as "Exploitation More Likely." No public PoC available at time of disclosure.
Business Impact
Authenticated attackers can escalate privileges to read email messages and attachments in other users' mailboxes within the same organization. Does not permit cross-tenant access. Risk limited to environments where attackers already have valid credentials. Out-of-band patch indicates Microsoft considers this a priority fix despite no observed in-the-wild abuse.
Urgency
🟠Within 24 hours
Recommended Actions
- Apply out-of-band security updates immediately to all on-premises Exchange Server installations (Subscription Edition RTM, 2016 CU23, 2019 CU14/CU15)
- Verify Exchange Online tenants are protected (server-side fix already deployed; no customer action needed)
- Review Exchange mailbox access logs for anomalous authenticated user activity, particularly cross-mailbox access patterns inconsistent with normal business operations
- Audit accounts with Exchange authentication to identify and disable unnecessary or stale credentials that could be leveraged for exploitation
- Monitor for privilege escalation attempts in Exchange environments using available logging and SIEM correlation rules