CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability

The issue carries a CVSS base score of 8.8 and a CVSS temporal score of 7.7. Its full CVSS vector is:

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Microsoft’s severity rating and scoring underline an important distinction for Exchange administrators: an attacker must already be authenticated, but no user interaction is required. Once that prerequisite is met, the potential effect is not merely a nuisance-level permission error.

What Microsoft says an attacker could access​

Microsoft’s official advisory describes CVE-2026-96940 as follows:

Microsoft Exchange Server Elevation of Privilege Vulnerability: Weak authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Click to expand...

Microsoft further states that an authenticated attacker who successfully exploits the vulnerability could gain unauthorized access to other users’ mailboxes within the same organization, including the ability to read email messages and attachments. The vulnerability does not allow access across tenant boundaries.

In plain operational terms, this makes mailbox confidentiality the central concern. Exchange mailboxes routinely hold password-reset messages, invoices, contracts, internal discussions, and attachments that may be far more valuable than the server itself. A flaw that can turn one valid account into access to other users’ mailboxes is exactly the sort of problem that deserves prompt attention—before it graduates from a patch-management ticket to an incident-response weekend.

Status and risk assessment​

• Publicly disclosed: No
• Exploited: No
• Microsoft’s exploitation assessment: Exploitation More Likely
• Customer action required: Yes

“Exploitation More Likely” should guide prioritization, particularly for organizations with Exchange servers accessible from untrusted networks or with large, diverse user populations. The advisory’s authentication requirement is meaningful, but it is not a free pass: compromised credentials, malicious insiders, or accounts obtained through separate phishing activity can satisfy that condition.

Affected Exchange Server products and fixed builds​

Microsoft identifies four affected on-premises product configurations. Administrators should deploy the security update that matches the installed cumulative update or Exchange Server Subscription Edition release, then confirm the server has reached the corresponding fixed build.

The vendor’s remediation guidance is explicit:

• For Microsoft Exchange Server 2016 Cumulative Update 23 (x64), install KB5129958 to reach fixed build 15.01.2507.075.
• For Microsoft Exchange Server 2019 Cumulative Update 14 (x64), install KB5129957 to reach fixed build 15.02.1544.048.
• For Microsoft Exchange Server 2019 Cumulative Update 15 (x64), install KB5129956 to reach fixed build 15.02.1748.053.
• For Microsoft Exchange Server Subscription Edition RTM (x64), install KB5129955 to reach fixed build 15.02.2562.053.

Exchange Online versus on-premises Exchange​

Exchange Online customers have a different action path. Microsoft says it has already deployed a related service-side fix to Exchange Online, and Exchange Online customers do not need to take action to receive that fix.

That does not extend to affected on-premises Microsoft Exchange Server products. Organizations operating Exchange Server 2016, Exchange Server 2019, or Exchange Server Subscription Edition should install the applicable security update listed above. Hybrid organizations should inventory their Exchange servers carefully rather than assuming their Microsoft 365 mailboxes settle the matter; the patched cloud service and an unpatched on-premises server are separate operational concerns.

Practical administrator priorities​

For affected on-premises deployments, the immediate job is straightforward:

• Identify the installed Exchange Server product and cumulative update.
• Select the matching KB update rather than treating Exchange servicing as a one-size-fits-all exercise.
• Install the applicable security update.
• Confirm the server reaches the stated fixed build.
• Treat mailbox access controls and account security as high-priority defensive layers while remediation is completed.

CVE-2026-96940 is a reminder that Exchange security is not solely about keeping attackers outside the front gate. Authorization flaws matter because a legitimate-but-limited account can become the starting point for broader internal mailbox access. In a platform built around highly sensitive communications, that is a risk administrators should close promptly.

Update: Additional details (October 5, 2026)​

WindowsReport reports that these fixes were issued as a second version of Microsoft’s September 2026 Exchange Server security updates. It also says Exchange Server 2016 and Exchange Server 2019 customers must be enrolled in the Period 2 Extended Security Update program to obtain the new patches; organizations without that coverage may need to migrate to Exchange Server Subscription Edition to remain eligible for security updates.

The report also notes post-installation considerations: published calendar .ics files can return HTTP 500 errors, while some Korean-language email processing scenarios can encounter ContentEngine deadlocks. Administrators should restart the Exchange server after applying the appropriate update, verify Exchange services start normally, and confirm both the intended KB and fixed build are installed.

Update: Additional details (October 6, 2026)​

Petri reports that hybrid organizations should also apply the V2 September 2026 updates to on-premises Exchange systems used for management purposes, including machines running Exchange Management tools—not solely mailbox servers.