Microsoft’s advisory says an unauthenticated attacker could send a specially crafted Visio attachment to an affected Exchange server. If the server processes that attachment during content indexing, successful exploitation could allow code execution on the server; user interaction is not required. For Exchange administrators, the operational concern is clear: mail content can reach the vulnerable processing path without a user opening or interacting with the attachment.
Microsoft published the advisory on September 8, 2026. The company lists Customer action required: Yes, so this is a patching item rather than a configuration-only advisory.
CVE-2026-55007: the score and exploitation conditions
CVE-2026-55007 carries a CVSS base score of 8.1 and a temporal score of 7.1. Microsoft’s supplied CVSS vector is CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C.
The vector describes a network-reachable attack with no privileges and no user interaction required. It also assigns High impacts to confidentiality, integrity, and availability. A successful exploit could therefore give an attacker code-execution capability on an Exchange server, which is a particularly sensitive role in most organizations because that server processes internal and external mail.
The limiting factor is attack complexity. Microsoft assigns the flaw an Attack Complexity rating of High, or AC:H, and says successful exploitation requires the target system to be under sustained low-memory, or memory-pressure, conditions. Such a state is not commonly present during normal operation, according to the advisory, making the flaw difficult to trigger reliably because an attacker would need to induce or wait for constrained memory conditions.
That qualification reduces exploit reliability; it does not remove the reason to patch. The advisory’s described attack path starts with a crafted Visio attachment and does not require credentials or a user to take action. Organizations running exposed Exchange infrastructure should treat capacity stress and content-indexing workloads as part of their risk assessment while installing the update, rather than regarding AC:H as a reason to defer it.
Microsoft’s current status fields are:
- Publicly disclosed: No
- Exploited: No
- Customer action required: Yes
Microsoft’s exploitation assessment is Exploitation Less Likely. That assessment reflects the high-complexity condition documented in the advisory, not an assurance that vulnerable servers are safe to leave unpatched.
Content indexing is the relevant server-side path
The technical description supplied by Microsoft is concise: “Double free in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.” A double free occurs when software releases the same allocation more than once, corrupting memory-management state. In the vulnerable Exchange handling path, Microsoft says processing a specially crafted Visio attachment during content indexing can lead to server-side code execution.
The distinction between attachment delivery and user interaction matters for administrators. Many organizations train users not to open suspicious attachments, but Microsoft explicitly states that user interaction is not required here. The relevant control point is the Exchange server’s own processing of message content, not a recipient deciding whether to open a file.
Microsoft’s advisory specifically identifies Visio attachments. Administrators should avoid assuming that ordinary mail-flow hygiene alone is a complete fix for this issue: the vendor has issued software updates for the affected product versions, and its stated customer action is installation of those updates.
The advisory also explains why exploitation may be hard to reproduce in a lab. A server must be under sustained memory pressure for the vulnerable condition to be reliably triggered. That makes a clean test environment a poor basis for deciding whether the exposure applies. Patch compliance should be measured by the installed Exchange build, not by whether an organization can reproduce the fault.
Affected Exchange versions and fixed builds
Microsoft lists three affected Exchange product lines, each with its own Knowledge Base package and fixed build. Administrators should match the update to the installed cumulative update or Subscription Edition release and verify the resulting build number after deployment.
| Affected product | Required update | Fixed build |
|---|---|---|
| Microsoft Exchange Server 2019 Cumulative Update 14 (x64) | KB5121610 | 15.02.1544.046 |
| Microsoft Exchange Server 2019 Cumulative Update 15 (x64) | KB5121609 | 15.02.1748.051 |
| Microsoft Exchange Server Subscription Edition RTM (x64) | KB5121608 | 15.02.2562.049 |
Microsoft’s remediation instructions are explicit:
- For Microsoft Exchange Server 2019 Cumulative Update 14 (x64), install KB5121610 to reach fixed build 15.02.1544.046.
- For Microsoft Exchange Server 2019 Cumulative Update 15 (x64), install KB5121609 to reach fixed build 15.02.1748.051.
- For Microsoft Exchange Server Subscription Edition RTM (x64), install KB5121608 to reach fixed build 15.02.2562.049.
The build number is the useful post-maintenance check. A completed update workflow is not, by itself, the security outcome Microsoft specifies; the server needs to reach the fixed build associated with its product version. Administrators should record the installed product line before maintenance, apply the corresponding KB, and confirm that the server reports the required fixed build afterward.
Patch the server rather than relying on attachment controls
CVE-2026-55007 is a server-side Exchange remote code execution issue with an unauthenticated delivery path and no required user interaction. Microsoft’s assessment says exploitation is less likely because sustained low-memory conditions are required, but the vulnerability’s 8.1 base score reflects the consequence if those conditions are met: code execution with high potential impact across confidentiality, integrity, and availability.
The immediate administrative action is therefore version-specific. Exchange Server 2019 Cumulative Update 14 (x64) should reach 15.02.1544.046 through KB5121610; Exchange Server 2019 Cumulative Update 15 (x64) should reach 15.02.1748.051 through KB5121609; and Exchange Server Subscription Edition RTM (x64) should reach 15.02.2562.049 through KB5121608.