CVE-2026-69641

CRITICAL9.1

Published 2026-09-08 · Updated 2026-09-08 · Source secure@microsoft.com

Description

Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

CWE-862

References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69641

View on NVD

Related CVEs

Same severity, most recent

CVE-2026-82004
Adobe Campaign Classic (ACC) is affected by an Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') vulnerability that could result in arbitrary code execution in the context of the current user. An attacker could exploit this vulnerability to execute arbitrary code. Exploitation of this issue does not require user interaction. Scope is changed.
2026-09-08 · score 10.0
CVE-2026-76201
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
2026-09-08 · score 9.3
CVE-2026-76200
Adobe Commerce is affected by a stored Cross-Site Scripting (XSS) vulnerability that could be abused by an attacker to inject malicious scripts into vulnerable form fields. Malicious JavaScript may be executed in a victim's browser when they browse to the page containing the vulnerable field, potentially gaining elevated access or control over the victim's account or session. Scope is changed.
2026-09-08 · score 9.3
CVE-2026-66302
External control of file name or path in Skype for Business allows an unauthorized attacker to execute code over a network.
2026-09-08 · score 9.8
CVE-2026-83941
Missing authorization in Entra ID allows an authorized attacker to elevate privileges over a network.
2026-09-08 · score 9.9