CVE-2026-69378: CWE-674: Uncontrolled Recursion in Microsoft Microsoft Exchange Server 2016 Cumulative Update 23

This vulnerability, identified as CWE-674 (Uncontrolled Recursion), exists in Microsoft Exchange Server 2016 Cumulative Update 23. An attacker without privileges can exploit this flaw remotely to cause a denial of service by forcing the server into uncontrolled recursive processing. The CVSS 3.1 base score is 7.5, indicating high severity, with network attack vector, low attack complexity, no privileges required, and no user interaction needed. The vulnerability impacts several builds of Exchange Server 2016 prior to the fixed versions. Microsoft has published an official security update to remediate this issue.

Exploitation of this vulnerability results in denial of service (DoS) on the affected Microsoft Exchange Server 2016 instances. The attacker can disrupt service availability remotely without requiring authentication or user interaction. There is no impact on confidentiality or integrity reported.

Microsoft has released an official fix for this vulnerability. Administrators should apply the security updates provided by Microsoft for Exchange Server 2016 to remediate this issue. Since this is not a cloud service, patching the affected on-premises servers is required. No additional mitigation steps are indicated by the vendor advisory.