This vulnerability, tracked as CVE-2026-55006 and categorized under CWE-1220, affects Microsoft Exchange Server 2016 Cumulative Update 23 (version 15.01.0.0). It arises from insufficient granularity in access control mechanisms, enabling an attacker who already has some level of authorization on the system to escalate their privileges locally. The CVSS 3.1 vector indicates low attack complexity and privileges required, no user interaction, and high impact on confidentiality, integrity, and availability. Microsoft has published an official fix for this vulnerability.

An attacker with local authorized access can exploit this vulnerability to elevate their privileges, potentially gaining higher-level permissions than intended. This can lead to full compromise of the affected system's confidentiality, integrity, and availability. There are no known exploits in the wild at this time.

An official fix is available from Microsoft. Users of Microsoft Exchange Server 2016 Cumulative Update 23 (version 15.01.0.0) should apply the vendor-provided patch as soon as possible. Refer to the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-55006 for detailed remediation instructions.