CVE-2026-118152

MediumCVSS 6.5/10Last modified Nov 10, 2026

Description

Cross-site request forgery (csrf) in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Metrics

CVSS 3.1 6.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N

Weakness enumeration

CWE-352

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
MicrosoftMicrosoft Exchange Server Subscription Edition RTM>= 15.02.0.0, < 15.02.2562.057

References

Timeline

Published
Nov 10, 2026
Last modified
Nov 10, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-1181537.5Inefficient algorithmic complexity in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.CVE-2026-1181548.8Reliance on untrusted inputs in a security decision in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a CVE-2026-1181577.2Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.CVE-2026-118168.1Keras versions prior to 3.14.0 are vulnerable to a path traversal issue in the archive extraction utilities located in `keras/src/utils/fileCVE-2026-1181646.4The If-So Dynamic Content – Elementor & All Page Builders Personalization plugin for WordPress is vulnerable to Stored Cross-Site Scripting CVE-2026-1181656.8The Firelight Lightbox WordPress plugin before 2.3.23 does not escape the URL of links it opens in its Classic lightbox before inserting it CVE-2026-1181664.8The MC4WP: Mailchimp for WordPress WordPress plugin before 4.15.0 does not prevent request-derived values in its dynamic content tags from bCVE-2026-1181675.3The MC4WP: Mailchimp for WordPress plugin before 4.15.0 does not validate that the Mailchimp audience a sign-up form or bundled integration CVE-2026-1181685.3The MapPress WordPress plugin before 2.97.15 does not restrict which user's data its front-end map embed handler renders, allowing unauthenCVE-2026-1181694.9The Hustle – Email Marketing, Lead Generation, Optins, Popups plugin for WordPress is vulnerable to Stored Cross-Site Scripting via the 'conCVE-2026-118175.3This vulnerability only affects Grafana stacks configured with multiple organizations; single-organization deployments are not impacted. In CVE-2026-1181709.1The strapi/review-workflows package is vulnerable to a broken access control vulnerability allowing updates to be made without verifying whe
CVE-2026-118152: Medium severity, CVSS 6.5 | Vulnix