CVE-2026-96940: Microsoft Exchange Vulnerability, Patch Now

Microsoft shipped an out-of-band security update on October 2, 2026, to close CVE-2026-96940, a high-severity elevation-of-privilege flaw in on-premises Exchange Server that lets an attacker who is already authenticated to an Exchange organization read other employees' mailboxes and attachments. The bug carries a CVSS base score of 8.8 and affects Exchange Server Subscription Edition RTM, Exchange Server 2019 (CU14 and CU15), and Exchange Server 2016 CU23. Exchange Online, Microsoft's hosted service, is not affected — Microsoft fixed the server-side logic there before disclosure, and cloud-only customers need to do nothing. Microsoft says it found the issue internally and is not aware of any active exploitation, and as of this writing the vulnerability has not been added to CISA's Known Exploited Vulnerabilities (KEV) catalog. Even so, Microsoft's own exploitability assessment is "Exploitation More Likely," and on-premises Exchange admins who have not installed the October 2 update should treat this as a same-week priority.

What is CVE-2026-96940?

CVE-2026-96940 is an elevation-of-privilege vulnerability in on-premises Microsoft Exchange Server. According to the official description Microsoft published for the flaw, it stems from weak authorization logic that an "authorized" (that is, already-authenticated) attacker can abuse over the network to gain privileges beyond what their account should have. In practice, that means a user who already holds a valid Exchange mailbox and password — whether a legitimate low-privilege employee account or credentials an outside attacker has stolen or guessed — can exploit the flaw to reach the mailbox contents and attachments of other users in the same organization.

Microsoft's own FAQ on the Security Update Guide advisory for CVE-2026-96940 is explicit that the bug does not cross tenant boundaries: an attacker cannot use it to jump from one organization's Exchange environment into a different company's environment. The risk is contained to mailboxes hosted within the same, already-compromised-at-some-level Exchange organization. That is an important distinction from a pre-authentication remote-code-execution bug — this is a confidentiality-focused privilege escalation that requires the attacker to already be inside the authentication perimeter, for example via a phished password, a reused credential, or an insider account.

How severe is it?

A CVSS score of 8.8 out of 10, as recorded in the National Vulnerability Database, puts CVE-2026-96940 in the upper range of severity, driven mainly by its full-network attack vector and the fact that it requires no user interaction once an attacker has any valid account. The access-complexity and privilege requirements are both rated low, which is why Microsoft's exploitability assessment leans toward "more likely" rather than "less likely." That said, the flaw is not a pre-authentication bug: it cannot be exploited by a completely anonymous, unauthenticated attacker. This nuance matters for how organizations should triage the patch — it is a priority, but it is not in the same emergency tier as an unauthenticated remote-code-execution flaw reachable from the open internet with no credentials at all.

How the flaw works, in plain terms

Exchange Server organizations are built around a permission model that is supposed to keep one mailbox owner from reading another mailbox owner's mail unless they have been explicitly granted access (for example, delegated calendar or shared-mailbox permissions). CVE-2026-96940 is classified under CWE-1390, a weakness category covering authentication and authorization mechanisms that don't fully enforce the boundaries they're supposed to. In this case, the weak-authorization check sits somewhere in the server-side logic that decides whether a given authenticated request should be allowed to reach another user's mailbox content.

Because exploitation requires network access to the Exchange server and a valid authenticated session, the realistic attack chain looks like this: an attacker obtains any valid set of Exchange credentials — through phishing, password spraying, credential stuffing against reused passwords, or simply holding a legitimate but low-privileged account inside the organization — and then sends crafted requests that the vulnerable authorization check fails to block. The result is read access to other mailboxes' messages and attachments, without needing administrator rights or Domain Admin-level compromise first. That makes the bug attractive to attackers who have already landed a single low-value account through unrelated means and are looking to expand what they can see, including executive or finance mailboxes that might contain sensitive attachments, credentials, or business-email-compromise material.

This is a different exploitation model from a zero-click exploit, which needs no authentication or user action at all. CVE-2026-96940 still requires that initial foothold, which is exactly why Microsoft's assessment is "more likely" rather than an active, mass-exploited emergency — but it also means the patch should be treated as closing a real post-compromise escalation path, not a theoretical one.

Affected versions and fixes

Microsoft shipped version-2 ("V2") security updates for four on-premises Exchange builds on October 2, 2026. Each update package resolves nine CVEs in total, with CVE-2026-96940 the newly added fix layered onto the September 2026 cumulative security update baseline. Organizations that already installed the original September updates still need to install the corresponding V2 package to close this specific vulnerability.

As with any Exchange cumulative-update-dependent servicing model, organizations running older cumulative updates than those listed must first update to a supported CU (2019 CU14/CU15 or 2016 CU23) before the security update will apply. Exchange Server 2013 and earlier are out of support entirely and do not receive a fix.

Is Exchange Online affected?

No. Exchange Online, the cloud/Microsoft 365 hosted mail service, is not affected by CVE-2026-96940. Microsoft has already deployed the fix on the service side, and customers who use Exchange Online exclusively — with no on-premises Exchange servers, including in hybrid configurations where only the cloud mailboxes are in scope — do not need to take any action for this specific CVE. The exposure is limited to organizations running their own on-premises Exchange Server infrastructure, including hybrid deployments where an on-premises Exchange server still exists for management or mail-flow purposes even if most mailboxes have migrated to the cloud.

Exploitation status and CISA KEV listing

Microsoft's advisory credits its own internal security teams with discovering CVE-2026-96940, and the company states it is not aware of any in-the-wild exploitation at the time of disclosure. As of this writing, CVE-2026-96940 does not appear in CISA's Known Exploited Vulnerabilities catalog, which CISA updates as it confirms active exploitation of specific CVEs and which triggers binding patch deadlines for U.S. federal civilian agencies once a vulnerability is added.

That status can change quickly. On-premises Exchange Server has a long history of being targeted within days of a patch's release, because security researchers and attackers alike can diff the patched and unpatched code to reverse-engineer a working exploit — a pattern seen repeatedly with prior Exchange elevation-of-privilege and remote-code-execution bugs. Microsoft's own "Exploitation More Likely" label on this advisory reflects that history: it is the company's own forecast, not a confirmation, that working exploit code is likely to surface. Administrators should not wait for a CISA KEV listing before patching; by the time a flaw is confirmed exploited and added to the catalog, unpatched servers have typically already been scanned and probed by opportunistic attackers.

Why on-premises Exchange is still a high-value target

Exchange Server has repeatedly been one of the most targeted pieces of enterprise software precisely because a single compromised server exposes the mail, calendars, and attachments of an entire organization — and because large numbers of self-hosted servers sit exposed to varying degrees on corporate networks, some still reachable from the internet for legacy mail-flow or mobile-device reasons. CVE-2026-96940 adds a mailbox-confidentiality angle to that risk profile: rather than full server takeover, it offers an attacker who already has one foothold account a way to silently read other employees' email, which is often the first step toward business email compromise, invoice fraud, or further lateral movement using information harvested from internal correspondence.

The timing compounds the urgency for some organizations. Exchange Server 2016 and Exchange Server 2019 reached the end of their standard support lifecycle in October 2025, and Microsoft has continued shipping security fixes for them only to customers enrolled in the paid Extended Security Updates (ESU) Period 2 program, which itself is scheduled to end in October 2026. Organizations still running Exchange 2016 or 2019 outside of ESU enrollment, or on cumulative updates older than CU23/CU14/CU15, will not receive this fix at all and should treat migration to a supported, patched version as an immediate planning priority alongside applying available updates elsewhere in their environment.

How to patch now: steps for Exchange admins

For organizations running on-premises Exchange Server, Microsoft's guidance follows the standard out-of-band update process, with a few points specific to this release:

1. Identify your current Exchange Server version and cumulative update using the Exchange admin center or Get-ExchangeServer | fl in the Exchange Management Shell, and confirm it matches one of the four affected combinations above.
2. Download and install the matching V2 security update from the KB article for your version: KB5129955 (Subscription Edition RTM), KB5129956 (2019 CU15), KB5129957 (2019 CU14), or KB5129958 (2016 CU23). If you already applied the original September 2026 security update, you still need the V2 package specifically to remediate CVE-2026-96940 — the earlier September build does not include this fix.
3. Apply the update to every Exchange server in the organization, including servers used only for management tooling, not just internet-facing mailbox servers, since the Exchange servicing model expects all servers in a site to run the same cumulative update and security update level.
4. Run the Exchange Server Health Checker script after installation, as Microsoft's own KB articles for these updates recommend, to confirm the update applied cleanly and to surface any configuration issues that could affect mail flow or future servicing.
5. Review Exchange and mailbox audit logs for unusual cross-mailbox access patterns predating the patch, particularly around mailbox export, impersonation, or application-level access that a low-privileged account should not have been able to perform.
6. Confirm hybrid configurations — organizations running Exchange hybrid with an on-premises server still in the environment should patch that server even if most or all mailboxes have moved to Exchange Online, since the on-premises component remains in scope for this CVE.

Because Exchange 2016 and 2019 are past standard end of support, teams without active Extended Security Updates coverage should also use this patch cycle to confirm their upgrade path to Exchange Server Subscription Edition, which is now the only on-premises version still receiving updates under Microsoft's standard servicing timeline.

After you patch: what to verify

Installing the update is the first step, not the last. Exchange admins should confirm the installed build number matches the fixed version listed in the table above (for example, 15.02.2562.053 or later for Subscription Edition RTM), since a failed or partial installation can leave a server reporting the wrong patch level. It's also worth re-checking any third-party or custom authentication integrations — anything that calls into Exchange Web Services, Remote PowerShell, or mailbox-access APIs — for unexpected permission grants that might have been exploited while the server was unpatched. Finally, keep an eye on Microsoft's Security Update Guide entry for CVE-2026-96940 and CISA's KEV catalog in the days ahead; if exploitation is later confirmed, both will be updated, and that would raise the urgency further for any organization that has not yet applied the fix.

Written bySana Qureshi

Sana Qureshi runs the security and privacy desk. She reports on actively exploited vulnerabilities, vendor patches and data breaches, and covers the password managers, VPNs and authentication tools readers use to protect themselves. Her alerts cite vendor advisories, CISA and the CVE record directly.

More from Sana QureshiAll Security & Privacy coverage