CVE-2026-69382: CWE-327: Use of a Broken or Risky Cryptographic Algorithm in Microsoft Microsoft Exchange Server 2016 Cumulative Update 23

This vulnerability (CVE-2026-69382) concerns the use of a broken or risky cryptographic algorithm in Microsoft Exchange Server 2016 Cumulative Update 23. The weakness enables unauthorized attackers to disclose sensitive information over a network. The CVSS 3.1 base score is 5.9 (medium severity), with network attack vector, high attack complexity, no privileges required, no user interaction, and impact limited to confidentiality. Microsoft has published an official fix for this issue, and affected versions are those prior to specific cumulative update builds as detailed.

An attacker without privileges or user interaction can exploit this vulnerability remotely to disclose sensitive information, potentially compromising confidentiality. There is no impact on integrity or availability reported. No known exploits are currently in the wild.

An official fix is available from Microsoft. Users should apply the security update for Microsoft Exchange Server 2016 Cumulative Update 23 as detailed in the Microsoft Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-69382. Applying this update remediates the vulnerability.