CVE-2026-70571, Microsoft Exchange Server: an unauthenticated crafted-email code-execution flaw in the October 2026 security updates, the last Exchange 2016 and 2019 updates under the paid ESU (CVSS 8.1)

Microsoft's October 2026 Exchange security updates, released on 2026-10-13, fix CVE-2026-70571, a stack-based buffer overflow in Exchange Server: an unauthenticated attacker could send a specially crafted email to an affected server, triggering an internal content-conversion process, with no user interaction (Microsoft Security Response Center, 2026-10-13). Microsoft rates it Critical (CVSS 8.1, high attack complexity) and Exploitation More Likely, and says exploitation requires a deep understanding of the target environment and is not guaranteed to succeed (Microsoft Security Response Center, 2026-10-13). CVE-2026-70279 is a cross-site scripting spoofing flaw (CVSS 9.3, also Exploitation More Likely): an attacker who persuades an administrator to click a crafted link could act with that administrator's privileges (Microsoft Security Response Center, 2026-10-13). Microsoft lists neither as exploited or publicly disclosed, and no other source reports exploitation.

The fixed builds are Exchange Server Subscription Edition RTM 15.02.2562.056, 2019 CU15 15.02.1748.055, 2019 CU14 15.02.1544.050 and 2016 CU23 15.01.2507.077 (Microsoft Security Response Center, 2026-10-13). The 2016 and 2019 updates are available only to organisations enrolled in the Period 2 ESU program, and October 2026 is the last month those customers receive newly released updates (Microsoft Exchange Team, 2026-10-13). After October, updates ship for Subscription Edition only, Microsoft's announcements and CVEs stop mentioning 2016 and 2019, and Microsoft says that does not mean those versions are not vulnerable and that it will stop testing them for vulnerabilities (Microsoft Exchange Team, 2026-10-13); buying Period 2 ESU later only gets an organisation current through this release (Microsoft Exchange Team, 2026-10-13). Exchange Online customers are already protected (Microsoft Exchange Team, 2026-10-13).