Microsoft Exchange Server · week of 26 Oct 2026
Microsoft Exchange Server security note
Records on this stack that changed between 26 Oct 2026 and the following Monday. Versions come from the stored ranges. A quiet week is not proof the stack is clear.
What changed
CVE-2026-42897 — Patch now
Microsoft Exchange Server Cross-Site Scripting Vulnerability
Affected < 15.02.2562.043
CVE-2026-87695 — Check if you run it
Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.
Affected < 15.02.2562.056
CVE-2026-87696 — Check if you run it
Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Affected < 15.02.2562.056
What we still do not know
Every changed record in this note has a version range.
Share this note
Microsoft Exchange Server security note, week of 26 Oct 2026: 3 records have a version a customer can check, and 0 still do not. https://zerodayfindings.com/technologies/exchange/notes/2026-W44