Related Posts
Read Time: 11 minutes
CVE-2026-96940 is a high-severity elevation-of-privilege Exchange server vulnerability that carries the CVSS score of 8.8. It affects several On-premises Exchange server versions. On October 2nd, 2026, Microsoft released a fix for this weak authorization bug in On-Prem Exchange Server versions that allowed any logged in user to open and view their coworkers’ mailbox data.
This guide talks about the basics of CVE-2026-96940, the affected versions of Exchange, the security impact it has on user mailboxes, and how admins can check whether their systems are protected or not.
If we explain CVE-2026-96940 in simple terms, it’s basically a dangerous security flaw in On-Premises Exchange Server that allows an attacker to gain control over multiple user’s mailboxes. It usually happens because of weak authorization when Exchange Server doesn’t properly check what a user is authorized to do. It was identified as a highly dangerous vulnerability by Microsoft on 2nd October 2026, with a CVSS score 8.8.
Some facts about CVE-2026-96940:
Hackers mainly use forgotten user accounts with low privileges to exploit this vulnerability. Any account of a user would work, but this vulnerability cannot be exploited without an Exchange account. Once the hacker gains access to a mailbox, they can access and read emails of almost all the users in an organization.
This is absolutely not a spam-filtering problem, it happens only because an attacker gains access to a mailbox of a specific organization. The practical risk is a stolen, phished, or misused account turning into access well beyond that account’s own mailbox. This is relevant to organizations that still use On-Premises Exchange Server, where the risk of unauthorized access exposing sensitive information is significantly high.
Because this error happens due to weak authorization, an authenticated attacker can get privileges that are more than what they intended to access users’ accounts. In an environment like Exchange Server, this becomes concerning because gaining access to such accounts can immediately let attackers view and steal confidential emails, attachments, and sensitive organizational information.
However, the description documented by Microsoft for this vulnerability identifies privilege escalation as the primary issue. It doesn’t mean that whenever this happens, every mailbox can automatically be accessed or that every successful hacking attempt results in mailbox data theft. The actual consequences mainly depend on the privileges that hackers get and what they do with those privileges.
Having a CVSS score of 8.8, CVE-2026-96940 poses a significant threat to organizations dependent on On-Premises Exchange Server for communication or collaboration purposes. If this vulnerability is exploited, an elevation-of-privilege flaw like this can allow attackers to easily skip security boundaries and gain access to sensitive information.
Thus, organizations must verify what version of Exchange Server they’re using, regularly monitor Microsoft’s official security guidance, and install the available security updates. Security and IT teams also need to investigate any potential suspicious activity either by a user or in the mailbox, if they suspect this vulnerability has been exploited.
For the latest technical details and remediation instructions, consult Microsoft’s official CVE-2026-96940 Security Update Guide.
What actions should Exchange Admins take right now?
Admins must patch every On-Premises Exchange server they have and then make sure they can prove in future who can read what.
To understand how CVE-2026-96940 works, it is important for users to know the difference between authentication and authorization. While authentication proves the identity of a user, authorization on the other hand, determines what actions that user is allowed to take and which resources they can access. The Exchange Server mainly relies on both of these to secure mailbox data and protect Exchange Server data from unauthorized access.
If the authorization controls of your organizations fail to implement the appropriate permissions to safeguard data, a hacker with correct credentials and necessary privileges would be able to bypass security boundaries. This would allow the hacker to read emails of other users within the same organization.
This vulnerability can be easily exploited over a network and requires only low-level privileges of access. Also, attackers don’t need any user interaction like clicking on a link or anything like that. This vulnerability doesn’t allow cross-tenant access for attackers and even unauthenticated users aren’t allowed for initial entry.
Administrators must install the relevant Microsoft Exchange Server security update and make sure that the server is operating with a fixed build to safeguard their organizational data. Most recently, Microsoft has released the out-of-band Version 2 of its September 20206 security update on October 2nd, 2026, for this vulnerability. We’ve divided the whole process in five steps to resolve this Exchange Server vulnerability.
Check the version of all your On-Premises Exchange Servers, including the servers used for hybrid environments. Record the version, cumulative update (CU), and current build number of each server. Also check whether your Exchange Server environment is protected by Microsoft Support or Extended Security Update (ESU) program.
Select the security update relevant to your Exchange Server’s version:
| Exchange Server version | Security update |
|---|---|
| Exchange Server Subscription Edition RTM | KB5129955 |
| Exchange Server 2019 CU15 | KB5129956 |
| Exchange Server 2019 CU14 | KB5129957 |
| Exchange Server 2016 CU23 | KB5129958 |
Backup all the required configurations with a trusted Exchange Backup solution and follow the installation instructions of Microsoft carefully. Schedule the maintenance of your server, communicate with the affected users, and make sure you’ve a proper recovery plan before proceeding with the update, to protect your data if anything goes wrong. Download and install the security update from the official Microsoft site and follow all the instructions properly. Once the installation is complete, restart the server and check if Exchange Server is starting correctly.
Once the security update is installed successfully, check its fixed build to see if it’s correct or not. Take the reference of this table to verify the fix build:
| Exchange Server version | Fix Build |
|---|---|
| Exchange Server Subscription Edition RTM | 15.02.2562.053 |
| Exchange Server 2019 CU15 | 15.02.1748.053 |
| Exchange Server 2019 CU14 | 15.02.1544.048 |
| Exchange Server 2016 CU23 | 15.01.2507.075 |
Although these are the reported minimum fix builds, it’s better if you verify them once from Microsoft’s Exchange Server build numbers and release dates for updated information.
Run Microsoft’s Exchange Server Health Checker to identify if there are any missing updates, any new configuration issues and or additional actions. Check that all Exchange services are healthy and mail flow is working as expected. In hybrid environments, check mailbox access and calendar functionality as well.
Finally, review available authentication, mailbox-access and audit logs for suspicious activity that may have occurred before patching. Installing the update closes the vulnerability but does not establish whether an earlier compromise occurred. If the update fails or Exchange services do not start correctly, follow Microsoft’s Exchange Server update troubleshooting guidance.
Once administrator’s have resolved the CVE-2026-96940 Exchange vulnerability, admins then monitor the activity of the Exchange Server to look for signs of any potentially unauthorized mailbox access. Even though unusual activity doesn’t exactly mean there’s any exploitation, looking for suspicious activity can help organizations in identifying the security threats that may have happened before installing the update and then preventing them in the future. Practice these defensive tips to detect any unusual activity:
There are multiple security issues apart from CVE-2026-96940 flaw that Exchange administrators must monitor. Other security issues can negatively affect authentication, mailbox security, or the connection between on-premises Exchange Server and Exchange Online. Reviewing these vulnerabilities helps administrators to identify additional requirements to protect their and prioritize security assessments.
The following table highlights two relevant vulnerabilities documented in Microsoft security advisories.
CVE identifier
| CVE identifier | Vulnerability and its impact | Who is Affected? | Microsoft’s Official advisory |
|---|---|---|---|
| CVE-2026-62911 | Authentication bypass vulnerability via capture-replay, potentially allowing an authorized attacker to elevate privilege over a network. | Exchange Server 2016 CU23, 2019 CU14/CU15, and Subscription Edition RTM | Microsoft advisory |
| CVE-2025-53786 | High severity privilege escalation risk related to hybrid Exchange deployments, potentially affecting the security of connected Exchange Online environments. | Supported and affected on-premises Exchange Server versions in hybrid configurations | Microsoft advisory |
Administrators must verify the affected build numbers, required updates, and current remediation guidance in the relevant advisories before taking any action. For CVE-2025-53786 specifically, they must pay attention to hybrid configurations and Microsoft’s guidance for protecting the connection between on-premises Exchange and Exchange Online.
CVE-2026-96940 vulnerability can be considered a good reminder that cyberattacks don’t always start from the outside. Someone with valid credentials and relevant privileges can cause a lot of damage. With a CVSS score of 8.8 (High), this vulnerability is worth paying attention to. Admins of the affected On-Premises Exchange Server SE, 2019, and 2016 must install the security update released on October 2nd, 2026. There’s no other workaround given by Microsoft, installing the update is the only way.
A. The only way to patch the CVE-2026-96940 is by installing the applicable October 2, 2026, V2 security update for your particular Exchange Server version. Check the build after the update and see the official Microsoft advisory for current instructions.
A. As per Microsoft, Exchange Online users are protected by a service-side fix. Organizations having hybrid deployments still need to check their On-Premises Exchange servers and management tools to spot any vulnerabilities.
A. No. This vulnerability can only work if the attacker is authenticated. This means that the attacker must have necessary permissions to exceed their intended mailbox permissions and access user data.
A. No, Microsoft hadn’t confirmed any active exploitation at the time of the initial October 2026 analysis. Although it assessed that the exploitation is a likely outcome. This status can change anytime, so admins must check Microsoft’s advisory and other reliable security sources periodically for the latest information.
A. Review your Exchange Server version and build information, then compare it with Microsoft’s Exchange Server build numbers and release dates. You can also run the Exchange Server Health Checker to identify update and configuration issues.
A. Check your Exchange version, update any prerequisites, look for installation errors and check eligibility for the particular security update. Exchange Server 2016 and 2019 updates released during the relevant 2026 period require enrollment in Microsoft’s Period 2 Extended Security Update (ESU) program. If your deployment is ineligible, consult Microsoft’s migration guidance and plan an upgrade to a supported version.
