GCVE-110-NCSC-2026-477

Advisory PublishedCVSS 7.1/10

Vulnetix · Advisory published November 10, 2026

An improper control of code generation vulnerability in Microsoft Exchange Server allows an authorized attacker to remotely execute code over a network, posing significant security risks.

Download JSON Look up in the Resolve Platform

Weaknesses (CWE)

CWE-94Improper Control of Generation of CodeCWE-639Authorization Bypass Through User-Controlled KeyCWE-73External Control of File Name or PathCWE-352Cross-Site Request ForgeryCWE-407Inefficient Algorithmic ComplexityCWE-807Reliance on Untrusted Inputs in a Security DecisionCWE-1390Weak AuthenticationCWE-706Use of Incorrectly-Resolved Name or Reference

Risk Scores

CVSS 3.1

7.1/10

High · CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:L/E:U/RL:O/RC:C

Affected Products

Vendor	Product	Versions	Platforms
Microsoft	vers:unknown/*	—	—

Aliases

CVE-2026-118149 CVE-2026-118150 CVE-2026-118151 CVE-2026-118152 CVE-2026-118153 CVE-2026-118154 CVE-2026-118157 CVE-2026-118207 CVE-2026-118208

References

advisory

Browse GCVE Records

851 records in the GCVE database · Updated November 12, 2026

No matching records found.

Explore Further

Investigate this vulnerability in the interactive console or download the raw GCVE record.

Look up in the Resolve Platform Download JSON