CVE-2026-69375: CWE-639: Authorization Bypass Through User-Controlled Key in Microsoft Microsoft Exchange Server 2016 Cumulative Update 23

This vulnerability (CVE-2026-69375) in Microsoft Exchange Server 2016 Cumulative Update 23 is classified under CWE-639 (Authorization Bypass Through User-Controlled Key). It allows an authorized attacker to bypass authorization controls by manipulating a user-controlled key, enabling tampering over a network. The CVSS 3.1 base score is 6.5, indicating medium severity, with network attack vector, low attack complexity, and no user interaction required. The vulnerability affects versions >=15.01.0.0 and <15.01.2507.073, >=15.02.0.0 and <15.02.1544.046, >=15.02.0.0 and <15.02.1748.051, and >=15.02.0.0 and <15.02.2562.049. Microsoft has released an official fix for this issue.

An authorized attacker can bypass authorization mechanisms by exploiting a user-controlled key, allowing tampering with the Microsoft Exchange Server 2016 system over a network. This could lead to unauthorized modifications impacting the integrity of the system. There is no reported confidentiality or availability impact. No known exploits are currently in the wild.

An official fix is available from Microsoft. Administrators should apply the security updates provided in the Microsoft advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69375 to remediate this vulnerability. No additional mitigation steps are indicated by the vendor.