Quick answers
- Is CVE-2026-69375 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-69375 being exploited in the wild.
- How severe is CVE-2026-69375?
- Medium severity, with a CVSS score of 6.5, published 8 September 2026.
- Which products and versions are affected?
- Microsoft Exchange Server.
- Is there a fix for CVE-2026-69375?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-69375 attacked?
- It is attacked over the network, in a hosted service.
- Am I affected by CVE-2026-69375?
- Check whether you run Microsoft Exchange Server. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
The vulnerability is an authorization bypass in Microsoft Exchange Server caused by improper validation of user-controlled cryptographic keys. An authenticated attacker can exploit this flaw to bypass authorization checks and perform data tampering over the network. The attack requires prior authentication and network access to the Exchange Server. Successful exploitation allows an attacker to modify data that should be protected by access controls. A patch is available from Microsoft.
Affected products
- Microsoft Exchange Server
Timeline
- 2026-09-08: disclosed