CVE-2026-62910 is a high severity (CVSS 7.2) resource injection flaw in Microsoft Exchange Server. An authorized attacker with high privileges can elevate privileges over the network. It affects Exchange Server and the Subscription Edition, and Microsoft's update guide lists the fix.
What's affected
The record names Microsoft Exchange Server and Exchange Server Subscription Edition. The weakness is CWE-99 (improper control of resource identifiers, often called resource injection).
The vector is network based with low complexity, requires high privileges and no user interaction, and has high impact on confidentiality, integrity and availability. The high privilege requirement narrows who can try it, but an account with those rights is a common target and a common thing to lose.
The record does not name specific build numbers. Use Microsoft's entry to find the Exchange security update for your cumulative update level.
How to check if you're exposed
Check your Exchange build number and compare it with Microsoft's list.
Get-ExchangeServer | Format-List Name, Edition, AdminDisplayVersion
Compare the AdminDisplayVersion with the build numbers in the Microsoft entry and the Exchange release notes. Also review who holds privileged Exchange roles, since an attacker needs one to use this flaw.
Whatever the product, a current inventory of what you run is what turns a CVE notice into a quick answer. The Gold page for this CVE tracks how its record changes over time, and the free in-browser dependency scan at gold.safeguard.sh/scan covers the application libraries you ship.
What to do now
- Run Get-ExchangeServer and note the build on each server.
- Install the Exchange security update that Microsoft lists for this CVE, after your usual test and backup steps.
- Review membership of privileged role groups and remove accounts that do not need them.
- Enable and review audit logging for administrative actions on Exchange.
- Protect administrative accounts with multifactor authentication and keep admin access off general browsing machines.
Why it matters
Resource injection means the application lets a caller choose which resource it works on, such as a file, object or identifier, and does not check that the choice is allowed. In a mail platform that can turn limited administrative rights into broader control.
Exchange is a high value target, so even bugs that need strong accounts get attention. The class is CWE-99. The record does not mark this CVE as exploited in the wild and it is not in CISA KEV; treat it as a priority patch, not an emergency.
Quick check
Does an ordinary mailbox user have the access needed?
The vector requires high privileges, so an ordinary mailbox user is not the assumed attacker. The risk centres on accounts with elevated Exchange rights.
Sources
Last reviewed: 18 October 2026.
