NCSC-NL flags 9 Exchange Server flaws
NCSC-NL advisory covers nine Microsoft Exchange Server vulnerabilities allowing privilege escalation, impersonation, RCE, and DoS; patches available.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 9 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- No exploitation in the wild and no public exploit is recorded for the CVEs named.
NCSC-NL published an advisory summarizing nine vulnerabilities patched by Microsoft in Exchange Server, covering weaknesses such as external control of file name/path, improper code generation control, CSRF, inefficient algorithmic complexity, authorization bypass through user-controlled key, reliance on untrusted inputs in security decisions, and weak authentication. Exploitation could allow an attacker to impersonate other users, escalate privileges, or execute arbitrary code with the privileges of the Exchange process. Several of the flaws carry high CVSS scores (up to 8.8), indicating significant impact if exploited, though the advisory does not indicate active exploitation in the wild.
The nine CVEs span a range of impacts: arbitrary code execution (CVE-2026-118149, CVE-2026-118207), privilege escalation (CVE-2026-118150, CVE-2026-118151, CVE-2026-118154, CVE-2026-118157), user impersonation (CVE-2026-118152, CVE-2026-118208), and denial-of-service (CVE-2026-118153). Microsoft has released updates addressing all nine issues. NCSC-NL recommends organizations running Exchange Server install the available patches promptly and consult Microsoft's security guidance portal for further details on remediation and any applicable workarounds.
This is a routine CERT patch advisory rather than a report of active exploitation or a specific campaign. Defenders operating on-premises Exchange Server should prioritize patch deployment given the mix of RCE and privilege-escalation vectors, which could be chained for full server compromise if left unpatched.
Mentioned in this report
Detection guidance
Exchange IIS Worker Process Spawning Shell or Script Interpreter
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
w3wp.exe running an MSExchange application pool that spawns a shell, script host or download LOLBin, which is typical of code execution through an Exchange server flaw. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Exchange IIS Worker Process Spawning Shell or Script Interpreter
description: Detects the IIS worker process of an Exchange application pool (MSExchange*AppPool)
spawning a command shell, script host or download utility. This is the typical post-exploitation
pattern when an Exchange vulnerability yields code execution in the Exchange process
context.
tags:
- attack.initial-access
- attack.execution
- attack.t1190
- attack.t1059
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains: MSExchange
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \rundll32.exe
- \regsvr32.exe
condition: selection
falsepositives:
- Third-party Exchange monitoring or health-check tooling that launches powershell.exe
from an Exchange app pool
- Exchange cumulative update or hybrid configuration tasks run through the ECP app
pool
level: high
id: 9db0115d-bfe4-5faf-8597-266ca1e37315
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0477.html
Exchange IIS Worker Process Writing Server-Side Script to Web Directories
A behavioural hunt for the technique in general, not a signature for the CVEs this report names.
w3wp.exe writing .aspx/.ashx/.asmx files into Exchange front-end or ASP.NET client web directories, indicating webshell placement after exploitation. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Exchange IIS Worker Process Writing Server-Side Script to Web Directories
description: Detects w3wp.exe creating ASP.NET script files in web-accessible Exchange
or IIS directories (aspnet_client, OWA/ECP auth folders). After an Exchange flaw
gives code execution or arbitrary file write, attackers commonly drop webshells
in these locations.
tags:
- attack.persistence
- attack.t1505.003
logsource:
category: file_event
product: windows
detection:
selection:
Image|endswith: \w3wp.exe
TargetFilename|contains:
- \aspnet_client\
- \FrontEnd\HttpProxy\owa\auth\
- \FrontEnd\HttpProxy\ecp\auth\
TargetFilename|endswith:
- .aspx
- .ashx
- .asmx
condition: selection
falsepositives:
- Exchange cumulative updates or security patches that regenerate auth page files
(typically written by setup processes rather than w3wp.exe)
level: high
id: 28075591-fbbc-50ab-a1f6-6766944b9d28
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0477.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0477.html
Free public brief. The detections with Splunk SPL already written (plus Elastic and KQL where they apply) are in the app with a free account, no card. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply) and live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs