This vulnerability, identified as CVE-2026-62911 and classified under CWE-294 (Authentication Bypass), affects Microsoft Exchange Server 2016 Cumulative Update 23 (version 15.01.0.0). It enables an attacker with some level of authorization to bypass authentication mechanisms through a capture-replay attack over the network, resulting in privilege escalation. The CVSS v3.1 base score is 8.0, indicating high impact on confidentiality, integrity, and availability. Microsoft has issued an official fix for this vulnerability as documented in their security advisory.

An attacker who is authorized on the network can exploit this vulnerability to bypass authentication controls and elevate their privileges, potentially gaining high levels of access and control over the affected Exchange Server instance. This can lead to full compromise of confidentiality, integrity, and availability of the system.

An official fix is available from Microsoft. Administrators should apply the security update provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-62911 to remediate this vulnerability.