Microsoft Exchange Server: remote code execution flaw (CVE-2026-118207) confirmed by Microsoft
Published 11/11/2026 11:05
Timeline
2 events over 8 d
- 02/11/2026 14:17ConfirmedBSI CERT-Bund (WID)+8 d
- 11/11/2026 11:05Published on WatchtowerPro CISO
In short
Microsoft has confirmed a remote code execution flaw in Microsoft Exchange Server, tracked as CVE-2026-118207. It is caused by improper input validation and lets an authorized attacker run code over a network. Affected versions and fixes are not yet published in the signals we have. Shodan recognises at least 35 internet-facing Microsoft Exchange Server servers worldwide, 5 of them in the EU (11/11/2026); the real number is likely higher, and how many run an affected version is not yet known.
How bad is it
Severity not yet rated: an attacker with authorized access can run code on an Exchange server over the network.
Confirmed by the vendor or a CERT - no exploitation reported yet.
Severity score
CVSS 3.1 from NVD, from microsoft.com, read 11/11/2026.
What an attacker needs
- Internet access to itEnough
- A loginA user account
- A user to clickNo
- Special settingsNo
Red helps the attacker, blue holds them back, grey is not published yet.
If it works, an attacker can
- Run their own code on the system
- Read the data it holds
- Change or delete that data
- Take it offline
Type: remote code execution.
A score is the worst case for the flaw, not a verdict on any one system. How we score · ReconX customers see which of their own systems are affected.
What to do now
- No fixed versions are confirmed. Check the Microsoft Security Update Guide entry for this CVE directly and install the update it names once confirmed.
- Interim measures reduce exposure and do not make a server safe. Keep Exchange management interfaces off the internet and keep Exchange on the latest cumulative and security updates.
ReconX customers see the full notice - and their own systems
Our customers are alerted at every phase. Until a patch exists, the ReconX agent watches their servers from the inside for anomalies, and our outside view - the attacker's view - shows which systems to fix first.
In ReconX: the full analysis, 5 open questions, followed up as sources answer and all 1 source with their dates. And technology matching: which of your systems run Microsoft Exchange Server, at which version, fixed or not - and what each one needs.
Main sources
CVE-2026-118207 Microsoft Exchange Server Remote Code Execution Vulnerability Vendor
Data: Shodan - Microsoft Exchange Server (estimate, 11/11/2026)