{"affected":[{"platforms":["x64-based Systems"],"product":"Microsoft Exchange Server Subscription Edition RTM","source":"CNA: microsoft","vendor":"Microsoft","versions":[{"lessThan":"15.02.2562.057","status":"affected","version":"15.02.0.0","versionType":"custom"}]}],"cveId":"CVE-2026-118208","cwes":["CWE-15","CWE-284"],"description":"Improper access control in Microsoft Exchange Server allows an authorized attacker to perform spoofing over a network.","epss":{"date":"2026-11-12","percentile":0.60777,"score":0.0092},"exploits":[],"kev":null,"metrics":[{"score":7.1,"severity":"high","source":"CNA: microsoft","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L/E:U/RL:O/RC:C","version":"3.1"},{"score":7.1,"severity":"high","source":"NVD: secure@microsoft.com","vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L","version":"3.1"}],"modifiedAt":1794520140875,"publishedAt":1794334909791,"references":[{"source":"CNA: microsoft","tags":["vendor-advisory","patch"],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118208"},{"source":"secure@microsoft.com","tags":[],"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118208"}],"remediation":[{"kind":"fix","source":"CNA: microsoft","text":"The reporting source identifies this reference as a patch. Check the advisory for affected versions and supported release branches.","url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-118208"}],"revision":"49da2454795b5cae89b9be14f075e9375da4eeb4e587948f4ca75824b5b78fb4","sources":[{"modifiedAt":1794520140875,"name":"CNA: microsoft","retrievedAt":1794522095469,"url":"https://www.cve.org/CVERecord?id=CVE-2026-118208"},{"modifiedAt":1794421153380,"name":"NVD","retrievedAt":1794443493762,"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-118208"},{"modifiedAt":null,"name":"FIRST EPSS","retrievedAt":1794500351160,"url":"https://api.first.org/data/v1/epss?cve=CVE-2026-118208"}],"ssvc":{"assessedAt":1794339860970,"automatable":"no","exploitation":"none","source":"ADP: CISA-ADP","technicalImpact":"partial"},"status":"published","title":"Microsoft Exchange Server Spoofing Vulnerability","updatedAt":1794522095469}