{"dataType":"CVE_RECORD","dataVersion":"5.0","cveMetadata":{"cveId":"GCVE-110-NCSC-2026-477","assignerOrgId":"","assignerShortName":"Vulnetix","state":"PUBLISHED","datePublished":"2026-11-10T20:04:46Z","dateUpdated":"","dateReserved":""},"containers":{"cna":{"providerMetadata":null,"title":"","descriptions":[{"lang":"nl","value":"An improper control of code generation vulnerability in Microsoft Exchange Server allows an authorized attacker to remotely execute code over a network, posing significant security risks.","supportingMedia":null},{"lang":"nl","value":"An authorization bypass vulnerability in Microsoft Exchange Server involving a user-controlled key allows an authorized attacker to elevate privileges over a network.","supportingMedia":null},{"lang":"nl","value":"An external control of file name or path vulnerability in Microsoft Exchange Server enables an authorized attacker to elevate privileges over a network.","supportingMedia":null},{"lang":"nl","value":"A cross-site request forgery (CSRF) vulnerability in Microsoft Exchange Server allows unauthorized attackers to perform network spoofing, potentially compromising network integrity.","supportingMedia":null},{"lang":"nl","value":"An inefficient algorithmic complexity vulnerability in Microsoft Exchange Server allows an unauthorized attacker to cause a denial of service over a network.","supportingMedia":null},{"lang":"nl","value":"A vulnerability in Microsoft Exchange Server enables an authorized attacker to elevate privileges over a network by exploiting reliance on untrusted inputs in a security decision.","supportingMedia":null},{"lang":"nl","value":"Weak authentication mechanisms in Microsoft Exchange Server allow an authorized attacker to elevate privileges over a network, potentially compromising system security.","supportingMedia":null},{"lang":"nl","value":"Improper input validation in Microsoft Exchange Server enables an authorized attacker to remotely execute code over a network, posing a significant security risk.","supportingMedia":null},{"lang":"nl","value":"Improper access control in Microsoft Exchange Server allows an authorized attacker to perform network spoofing, potentially compromising network integrity.","supportingMedia":null}],"references":[{"url":"https://advisories.ncsc.nl/csaf/v2/2026/ncsc-2026-0477.json","name":"","tags":["advisory"]},{"url":"https://portal.msrc.microsoft.com/en-us/security-guidance","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118149.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118150.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118151.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118152.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118153.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118154.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118157.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118207.json","name":"","tags":["advisory"]},{"url":"https://vulnerabilities.ncsc.nl/csaf/v2/2026/cve-2026-118208.json","name":"","tags":["advisory"]}],"metrics":[{"format":"","scenarios":null,"cvssV2_0":null,"cvssV3_0":null,"cvssV3_1":{"version":"3.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L/E:U/RL:O/RC:C","baseScore":7.1,"baseSeverity":"HIGH"},"cvssV4_0":null,"other":null}],"problemTypes":[{"descriptions":[{"lang":"en","description":"Improper Control of Generation of Code","cweId":"CWE-94","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Authorization Bypass Through User-Controlled Key","cweId":"CWE-639","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"External Control of File Name or Path","cweId":"CWE-73","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Cross-Site Request Forgery","cweId":"CWE-352","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Inefficient Algorithmic Complexity","cweId":"CWE-407","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Reliance on Untrusted Inputs in a Security Decision","cweId":"CWE-807","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Weak Authentication","cweId":"CWE-1390","type":"CWE"}]},{"descriptions":[{"lang":"en","description":"Use of Incorrectly-Resolved Name or Reference","cweId":"CWE-706","type":"CWE"}]}],"affected":[{"vendor":"Microsoft","product":"vers:unknown/*","collectionURL":"","packageName":"","repo":"","defaultStatus":"","versions":null,"cpes":null,"modules":null,"programFiles":null,"platforms":null}],"cpeApplicability":null,"rejectedReasons":null,"replacedBy":null,"x_vulnetix_aliases":{"direct":["CVE-2026-118149","CVE-2026-118150","CVE-2026-118151","CVE-2026-118152","CVE-2026-118153","CVE-2026-118154","CVE-2026-118157","CVE-2026-118207","CVE-2026-118208"]}},"adp":null}}