Microsoft has fixed a critical remote code execution flaw in Exchange Server, CVE-2026-118207, scored 8.8 out of 10, that lets an attacker with a valid account run code on a mail server by sending it malformed input. The flaw was patched on 10 November 2026 as part of Microsoft's November Patch Tuesday.

Exchange Server is the mail server at the heart of many organisations, holding their email and calendars. A remote code execution flaw there is serious because code running on the mail server can be used to read mail, steal credentials and move deeper into the network. In this case the attacker must already hold a valid account, which is what keeps the score at 8.8 rather than higher, but Microsoft has assessed exploitation as more likely, meaning it expects attackers to try. The flaw was fixed alongside 1,093 other flaws in this month's release, 63 of them rated critical.

Why Exchange flaws are treated seriously

Mail servers are attractive targets. They are usually reachable from the internet, they hold sensitive messages, and they sit inside the trusted part of a network. Flaws in Exchange Server have been exploited in the wild before, which is why security teams treat every critical Exchange fix as urgent rather than routine. An attacker who gains code execution on an Exchange server does not need to phish anyone afterwards: they are already inside, on a system other servers trust.

What administrators should do

Apply the November 2026 Exchange Server security updates as soon as possible, starting with servers that face the internet, then the rest of the estate. After patching, review which accounts can reach the server and remove access that is no longer needed, since this flaw requires an authenticated attacker. Watch for unusual activity on mail servers, such as unexpected processes or new accounts. Organisations that cannot patch immediately should limit who can reach their Exchange servers from outside and monitor them closely until the update is in place. Tenable and BleepingComputer both list CVE-2026-118207 among the notable fixes in the November release.

Frequently asked questions

Is CVE-2026-118207 being exploited? No. It was not flagged as exploited when the patch shipped on 10 November 2026, but Microsoft assessed exploitation as more likely, so patching should not wait.

What does authenticated mean here? The attacker needs a valid account on the system first. That is a real barrier, but stolen or weak credentials are common, so it should not be treated as safety.

How is it different from the Outlook zero-day? The Outlook spoofing flaw CVE-2026-124194 was the only flaw in this release marked as actively exploited. CVE-2026-118207 had not been seen in attacks at release, but it is rated more likely to be exploited.