CVE-2026-69355 External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over…

Description

External control of file name or path in Microsoft Exchange Server allows an authorized attacker to execute code over a network.

Affected products and versions

Product	Affected versions	Fixed in
Microsoft Exchange Server 2016 Cumulative Update 23 15.01	15.01.0.0 → < 15.01.2507.073	15.01.2507.073
Microsoft Exchange Server 2019 Cumulative Update 14 15.02	15.02.0.0 → < 15.02.1544.046	15.02.1544.046
Microsoft Exchange Server 2019 Cumulative Update 15 15.02	15.02.0.0 → < 15.02.1748.051	15.02.1748.051
Microsoft Exchange Server Subscription Edition RTM 15.02	15.02.0.0 → < 15.02.2562.049	15.02.2562.049

Other CVEs of Microsoft Exchange Server 2016 Cumulative Update 23

The 88 CVEs of Microsoft Exchange Server 2016 Cumulative Update 23 →

CVE-2026-87695 Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to… 7.8 High CVE-2026-87692 Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges… 7.8 High CVE-2026-70279 Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows… 9.3 Critical CVE-2026-87696 Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate… 7.5 High