Microsoft Exchange Server Elevation of Privilege Vulnerability (CVE-2026-87695)
Severity: medium · Patch status: patched · Since 2026-10-13 · CVE-2026-87695
Microsoft's October 2026 Patch Tuesday (published 2026-10-13) addresses CVE-2026-87695, an elevation of privilege vulnerability in Microsoft Exchange Server caused by inclusion of functionality from an untrusted control sphere. An attacker who is already authorized on the system can exploit the flaw to elevate privileges locally. No common name has been assigned, and sources do not state CVSS scores, affected or fixed versions, or any exploitation in the wild. A security update is available via the Microsoft Security Update Guide, so organizations running Exchange Server should apply the October 2026 updates promptly, prioritizing internet-facing and privileged-access Exchange infrastructure.
What to do
- Apply the October 2026 Microsoft security updates to all Exchange Server deployments, starting with internet-facing servers
- Review accounts with authorized local access to Exchange servers for signs of misuse or unexpected privilege changes
- Restrict local logon and administrative access to Exchange servers to essential personnel
- Monitor Exchange servers for anomalous privilege escalation activity following patching
Sources
All live incidents on Threat Watch
