---
schema: 1
kind: vulnerability
title: "CVE-2026-70571, Microsoft Exchange Server: an unauthenticated crafted-email code-execution flaw in the October 2026 security updates, the last Exchange 2016 and 2019 updates under the paid ESU (CVSS 8.1)"
headline: "Exchange October updates fix an unauthenticated email-borne RCE; 2016 and 2019 get their last update, and only with ESU"
summary: >
  Microsoft's 2026-10-13 Exchange security updates fix CVE-2026-70571, a stack-based buffer overflow that an unauthenticated attacker can trigger with a crafted email (Critical, CVSS 8.1 with high attack complexity, Exploitation More Likely, not exploited), and CVE-2026-70279, a 9.3 cross-site scripting flaw that lets an attacker act as an administrator who clicks a crafted link. October is the last month Exchange 2016 and 2019 customers enrolled in the Period 2 ESU receive newly released updates, and organisations without ESU have no 2016 or 2019 update at all.
discovered_at: "2026-10-14T03:40:00Z"
updated_at: null
event_date: "2026-10-13"
run_id: 2026-10-14T0255Z-intel
priority: notable
immediate_action: null
tags: [vulnerabilities, rce, pre-auth, patch-available]
regions: [global]
sectors: [technology]
entities: ["product:microsoft-exchange-server"]
techniques: [T1190, T1566.002]
affected_products: ["Microsoft Exchange Server Subscription Edition", "Microsoft Exchange Server 2019", "Microsoft Exchange Server 2016"]
cves:
  - id: CVE-2026-70571
    cvss: "8.1"
    epss: null
    type: memory-corruption
    vector: zero-click
    auth: pre-auth
    status: [patch-available]
    affected: "Exchange Server Subscription Edition, 2019 CU14 and CU15, 2016 CU23 (builds before the October 2026 updates)"
    fixed: "SE RTM 15.02.2562.056 (KB5128895), 2019 CU15 15.02.1748.055 (KB5128896), 2019 CU14 15.02.1544.050 (KB5128897), 2016 CU23 15.01.2507.077 (KB5128898)"
  - id: CVE-2026-70279
    cvss: "9.3"
    epss: null
    type: xss
    vector: user-interaction
    auth: pre-auth
    status: [patch-available]
    affected: "Exchange Server Subscription Edition, 2019 CU14 and CU15, 2016 CU23 (builds before the October 2026 updates)"
    fixed: "SE RTM 15.02.2562.056 (KB5128895), 2019 CU15 15.02.1748.055 (KB5128896), 2019 CU14 15.02.1544.050 (KB5128897), 2016 CU23 15.01.2507.077 (KB5128898)"
sources:
  - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571"
    publisher: "Microsoft Security Response Center"
    date: "2026-10-13"
    role: primary
  - url: "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70279"
    publisher: "Microsoft Security Response Center"
    date: "2026-10-13"
    role: primary
  - url: "https://techcommunity.microsoft.com/blog/exchange/released-october-2026-exchange-server-security-updates/4563014"
    publisher: "Microsoft Exchange Team"
    date: "2026-10-13"
    role: primary
closed_sources: []
evidence: []
verification: single-source
sourcing_note: "Microsoft is the only source; it is the vendor and the disclosing party for its own product. No source reports exploitation."
confidence: high
references: []
deep_dive: false
deep_dive_category: null
org_triage: null
classification:
  reliability: A
  credibility: 2
watchlist_hit: false
actions:
  - "Install the October 2026 Exchange security update on every Exchange server and on every machine that has the Exchange Management Tools; on Exchange 2016 and 2019 servers that are not covered by the Period 2 ESU, decide now between enrolling (it only gets an organisation current through this release) and moving to Exchange Subscription Edition, because after October Microsoft ships updates for Subscription Edition only."
updates: []
migrated_from: null
---

Microsoft's October 2026 Exchange security updates, released on 2026-10-13, fix CVE-2026-70571, a stack-based buffer overflow in Exchange Server: an unauthenticated attacker could send a specially crafted email to an affected server, triggering an internal content-conversion process, with no user interaction ([Microsoft Security Response Center, 2026-10-13](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571)). Microsoft rates it Critical (CVSS 8.1, high attack complexity) and Exploitation More Likely, and says exploitation requires a deep understanding of the target environment and is not guaranteed to succeed ([Microsoft Security Response Center, 2026-10-13](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571)). CVE-2026-70279 is a cross-site scripting spoofing flaw (CVSS 9.3, also Exploitation More Likely): an attacker who persuades an administrator to click a crafted link could act with that administrator's privileges ([Microsoft Security Response Center, 2026-10-13](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70279)). Microsoft lists neither as exploited or publicly disclosed, and no other source reports exploitation.

The fixed builds are Exchange Server Subscription Edition RTM 15.02.2562.056, 2019 CU15 15.02.1748.055, 2019 CU14 15.02.1544.050 and 2016 CU23 15.01.2507.077 ([Microsoft Security Response Center, 2026-10-13](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-70571)). The 2016 and 2019 updates are available only to organisations enrolled in the Period 2 ESU program, and October 2026 is the last month those customers receive newly released updates ([Microsoft Exchange Team, 2026-10-13](https://techcommunity.microsoft.com/blog/exchange/released-october-2026-exchange-server-security-updates/4563014)). After October, updates ship for Subscription Edition only, Microsoft's announcements and CVEs stop mentioning 2016 and 2019, and Microsoft says that does not mean those versions are not vulnerable and that it will stop testing them for vulnerabilities ([Microsoft Exchange Team, 2026-10-13](https://techcommunity.microsoft.com/blog/exchange/released-october-2026-exchange-server-security-updates/4563014)); buying Period 2 ESU later only gets an organisation current through this release ([Microsoft Exchange Team, 2026-10-13](https://techcommunity.microsoft.com/blog/exchange/released-october-2026-exchange-server-security-updates/4563014)). Exchange Online customers are already protected ([Microsoft Exchange Team, 2026-10-13](https://techcommunity.microsoft.com/blog/exchange/released-october-2026-exchange-server-security-updates/4563014)).

**Exposure:** on-premises Exchange Subscription Edition, 2019 CU14 and CU15 and 2016 CU23 that receive external mail for CVE-2026-70571, and administrator sessions in the web interfaces for CVE-2026-70279. The update also has to go onto machines that only run the Exchange Management Tools ([Microsoft Exchange Team, 2026-10-13](https://techcommunity.microsoft.com/blog/exchange/released-october-2026-exchange-server-security-updates/4563014)).

**Detection:** no source describes exploitation behavior. Microsoft says a successful attempt is not guaranteed, so, as an inference from the mechanism, a failed attempt would more likely appear as a crash than a shell: watch for crashes and application-log faults of the Exchange transport processes right after inbound mail from outside, and for unexpected child processes of those processes.

**Defender takeaway:** install the October update on every Exchange server and management-tools machine, because Microsoft rates both flaws Exploitation More Likely. An organisation still on Exchange 2016 or 2019 without Period 2 ESU has no update for CVE-2026-70571 and no further updates after this one; the choices are enrolling, which ends at October's release, or moving to Subscription Edition.