CVE-2026-96940

Published Oct 2, 2026

Last updated a day ago

Overview

AI description

Automated description summarized from trusted sources.

CVE-2026-96940 is an elevation of privilege vulnerability in Microsoft Exchange Server stemming from weak authorization mechanisms. An authenticated attacker can exploit this flaw over a network to elevate their privileges without requiring any user interaction. Successful exploitation allows the attacker to access other users' mailboxes within the same organization, read email messages and attachments, modify server configurations, and disrupt service availability. The vulnerability affects on-premises deployments, including Microsoft Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Updates 14 and 15, and Exchange Server Subscription Edition RTM. Microsoft discovered the flaw internally and reported no evidence of active exploitation or public proof-of-concept exploits. To address the issue, Microsoft released the September 2026 V2 security updates. Exchange Online customers are already protected and do not require further action.

Description: Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
Source: secure@microsoft.com
NVD status: Received

Risk scores

CVSS 3.1

Type: Secondary
Base score: 8.8
Impact score: 5.9
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Severity: HIGH

Weaknesses

secure@microsoft.com: CWE-1390

Hype score is a measure of social media activity compared against trending CVEs from the past 12 months. Max score 100.

Hype score: 7

References