home / blog
2026-10-13 · high
Microsoft Exchange Server: stack buffer overflow (CVE-2026-70571)
Stack buffer overflow in Exchange Server allowing code execution over the network, CVSS 3.1 8.1. Install the Microsoft October 2026 patch.
On 13 October 2026 Microsoft published the record for CVE-2026-70571, a stack buffer overflow in Exchange Server that lets an unauthorised attacker execute code over the network. NVD assigns CVSS v3.1 8.1 (high), with high attack complexity.
Several secondary sources describe it as critical. The official NVD record, however, rates it high: it should be reported that way, so as not to overstate the risk beyond what the vendor states.
Install the Microsoft October 2026 patch on all Exchange servers, including unused but still reachable installations. Check the MSRC bulletin for the correct KB for your version.
At a glance
- What
- Stack buffer overflow in Microsoft Exchange Server. An unauthorised attacker can execute code over the network.
- Severity
- CVSS v3.1 8.1 (high) according to NVD. Attack complexity is high (AC:H). Some secondary sources call it critical: NVD rates it high.
- Cause
- Stack buffer overflow (CWE-121).
- Fix
- Microsoft patch from October 2026. Confirm the KB for your Exchange version on the MSRC bulletin.
- Action
- Apply the patch to all Exchange servers, including unused installations that are still reachable.
Sources: NVD, CVE-2026-70571 · Microsoft MSRC, CVE-2026-70571