CVE-2026-118149

High (8.8)—

Schedule the patchSeverity High 8.8. No public exploit or active exploitation known.

Severity8.8High · CVSS 3.1

Exploitation probability1.12 %higher than 67% of CVEs · score from Nov 11, 2026

Active exploitationNonot in the CISA catalog · checked Nov 12, 03:00 AM

Public exploitNot knownno public code found

News and reports on Orbitaley

Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

Timeline

Built from our own data: NVD, CISA KEV and other exploitation catalogues, FIRST EPSS, public exploits, specialised media and Orbitaley coverage.

Nov 10, 2026CVE record published in NVD
Nov 10, 2026Alert: Microsoft fixes 200 vulnerabilities, including an Outlook flaw CISA confirms is being exploited
Nov 10, 2026First mention in specialised media (NCSC-NL)

Media coverage

Specialised security media that have cited this CVE:

NCSC-NL · NCSC-2026-0477 [1.00] [M/H] Kwetsbaarheden verholpen in Microsoft Exchange server (Nov 10, 2026)

ATT&CK techniques

How this vulnerability is exploited and what the attacker gains, in MITRE ATT&CK terms.

ExploitationT1210 Exploitation of Remote Serviceslateral movement85 %
Primary impactT1059 Command and Scripting Interpreterexecution80 %

El vector CVSS indica red (AV:N) con privilegios bajos (PR:L) y sin interacción; la descripción señala inyección de código que permite ejecutar código por red, sin especificar intérprete.

Inferred by our analysis agent from the official description, CVSS vector and CWE, and checked by a supervisor. May contain errors.

ATT&CK mitigations that cover these techniques

Privileged Account Management Disable or Remove Feature or Program Vulnerability Scanning Threat Intelligence Program Restrict Web-Based Content Network Segmentation

Affected technologies (1)

⚠ AI-inferred from the description — NVD hasn't analyzed this CVE yet, these aren't verified CPEs.

Microsoft — Exchange Server^AI

NVD record

NVD status: Awaiting Analysis
Published: Nov 10, 2026
Last modified: Nov 10, 2026
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Weakness (CWE): CWE-94

References

Referencemsrc.microsoft.com/update-guide/vulnerability/CVE-2026-118149

Raw JSON (NVD)

Show

{
  "id": "CVE-2026-118149",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-118149",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "total"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2026-11-10T19:45:56.377618Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "secure@microsoft.com",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 8.8,
          "attackVector": "NETWORK",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft Exchange Server Subscription Edition RTM",
          "versions": [
            {
              "status": "affected",
              "version": "15.02.0.0",
              "lessThan": "15.02.2562.057",
              "versionType": "custom"
            }
          ],
          "platforms": [
            "x64-based Systems"
          ]
        }
      ]
    }
  ],
  "published": "2026-11-10T19:19:36.440",
  "references": [
    {
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118149",
      "source": "secure@microsoft.com"
    }
  ],
  "vulnStatus": "Awaiting Analysis",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "secure@microsoft.com",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Improper control of generation of code ('code injection') in Microsoft Exchange Server allows an authorized attacker to execute code over a network."
    }
  ],
  "lastModified": "2026-11-10T20:18:14.450",
  "sourceIdentifier": "secure@microsoft.com"
}