CVE-2026-118150

HighCVSS 8.8/10Last modified Nov 10, 2026

Description

Authorization bypass through user-controlled key in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Metrics

CVSS 3.1 8.8/10CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-639

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

No affected versions have been published.

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1181517.2External control of file name or path in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-1181526.5Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.CVE-2026-1181537.5Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.CVE-2026-1181548.8Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a CVE-2026-1181577.2Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-118168.1Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/fileCVE-2026-1181646.4The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-1181656.8The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it CVE-2026-1181664.8The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from bCVE-2026-1181675.3The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration CVE-2026-1181685.3The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenCVE-2026-1181694.9The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'con
CVE-2026-118150: High severity, CVSS 8.8 | Vulnix