CVE-2026-55007: Unauthenticated Exchange Server RCE via a Malicious Visio Attachment

If your organization still runs Exchange Server on-premises, a new vulnerability disclosed in Microsoft’s September 2026 Patch Tuesday deserves immediate attention. CVE-2026-55007 lets an attacker gain remote code execution on an affected Exchange server simply by sending an email. No link clicks, no macro warnings, no user interaction at all.

What CVE-2026-55007 actually is

CVE-2026-55007 is a double free vulnerability (CWE-415) in the content indexing engine built into Exchange Server. When Exchange receives a message, it automatically indexes any attachments so the content becomes searchable in mailbox search. That indexing step is where the flaw lives: a specially crafted Visio (.vsdx) attachment can trigger the same memory region being freed twice, corrupting memory in a way that an attacker can turn into remote code execution.

Because indexing happens automatically on receipt, exploitation needs nothing from the recipient. The email just has to arrive.

• CVSS score: 8.1
• Attack vector: network, unauthenticated, zero-click
• Affected versions: Exchange Server 2019 Cumulative Update 14 and CU15, and Exchange Server Subscription Edition RTM
• Fix: Security Update KB5121608, published September 8, 2026

Quick guide: check your version and patch

Run this on each Exchange server to see the exact build you’re on before you patch:

Get-ExchangeServer | Select-Object Name, AdminDisplayVersion
Get-Command ExSetup.exe | ForEach-Object { $_.FileVersionInfo.FileVersion }

Cross-check the build number against Microsoft’s servicing page for Exchange Server 2019 and Subscription Edition to confirm whether you’re on CU14, CU15, or the Subscription Edition RTM baseline covered by this advisory.

Then patch:

1. Download KB5121608 from the Microsoft Update Catalog for your exact CU/build.
2. Take a current backup or snapshot of the Exchange server first, as with any CU-level update.
3. Install the update during a maintenance window. Exchange security updates typically require the server to be in a healthy state (run Get-ExchangeServer and check Health Mailbox / managed availability probes before and after).
4. Reboot if prompted, then re-run the version check above to confirm the fix applied.

If you can’t patch immediately

Microsoft has not published an official workaround for this one, because the attack needs no user interaction. The content indexing pipeline processes attachments automatically regardless of mailbox rules or client settings, so there is no reliable client-side mitigation. Patching is the only real fix. If you are unable to patch right away, isolating the Exchange server’s exposure (restricting inbound SMTP to only what’s genuinely required, and watching for anomalous Exchange crashes or EventID entries tied to content indexing) can reduce your window of exposure, but it is not a substitute for the update.

FAQ

Do I need to open the attachment for this to trigger? No. Indexing happens automatically on receipt, before anyone opens anything.

Does this affect Exchange Online? No, this is specific to on-premises Exchange Server 2019 CU14/CU15 and Subscription Edition RTM. Exchange Online is patched centrally by Microsoft.

Is there proof of active exploitation? At disclosure, this was flagged by the Zero Day Initiative as a top-priority Patch Tuesday item because of how easily it can be weaponized, not because of confirmed in-the-wild attacks. Treat it as high risk regardless and patch promptly.

Sources: Microsoft Security Response Center advisory for CVE-2026-55007; security update KB5121608.