An Exchange server can process a malicious attachment before anyone opens the message. Microsoft’s November 10, 2026 release puts both the Exchange application and the underlying Windows build on the patch list.
Last verified November 10, 2026 (UTC).
Two critical flaws, two patch checks
CVE-2026-116928, Windows Search (Critical, CVSS 3.1 9.8). Microsoft describes unauthenticated code execution when on-premises Exchange automatically indexes an attachment. The recipient does not have to open it. MSRC lists Windows Server 2016, 2019, 2022 and 2025 (including Core), and Windows 10 and 11 versions in the OS matrix. It supplies Windows updates and does not map the mail-indexing scenario to specific Exchange CUs. Verify applicability for the installed Exchange role and host build.
CVE-2026-118207, Exchange Server (Critical, CVSS 3.1 8.8). Network access and low-level authentication are required. No user interaction is required. MSRC lists Exchange Server Subscription Edition RTM and KB5133453, fixed build 15.02.2562.057. It does not give a lower affected build boundary.
Microsoft reports no exploitation or public disclosure for either flaw. It assesses exploitation more likely for CVE-2026-118207 and less likely for CVE-2026-116928. Neither appears in the CISA KEV snapshot reviewed November 10.
Suggested MSP priority: urgent for on-premises servers accepting untrusted mail
Inventory Exchange edition, build and host Windows release, including hybrid management servers and passive nodes. Limit unnecessary external service exposure and maintain mail-gateway filtering while patching. Install the Exchange SU and the applicable Windows update. Server 2016 uses KB5131291, 2019 KB5131085, 2022 KB5131090, and 2025 KB5131080 or the applicable KB5131077 hotpatch. Verify both builds and test mail flow, indexing, and DAG health where applicable. No CVE-specific workaround, compromise-check procedure, or rotation requirement was verified.
Official sources
Windows Search CVE-2026-116928 · Exchange CVE-2026-118207 · Exchange KB5133453 · Microsoft November CVRF · CISA KEV