CVE-2026-96940 is an authorization flaw in on-premises Exchange Server that lets a signed-in user open other people’s mailboxes in the same organization, attachments included. Microsoft scored it CVSS 8.8, found it internally, and says it is not aware of active exploitation. It still rates exploitation as more likely, and that label is the reason to move this ahead of routine maintenance.
The fix shipped on October 2, 2026 as a V2 re-release of the September Exchange security updates. If you installed the September update on schedule, you do not have this fix yet.
What CVE-2026-96940 Allows and What It Doesn’t
The bug is weak authorization checking inside Exchange. An attacker who already holds valid credentials can reach it over the network and read mailboxes that are not theirs. No user interaction is needed, and Microsoft’s advisory states that it does not allow access across tenant boundaries.
It is narrower than the Exchange emergencies most admins remember. CVE-2026-96940 gives no unauthenticated remote code execution and no direct path to domain admin, which separates it from the ProxyLogon and ProxyShell family. It is also unrelated to CVE-2026-62911, the August pre-authentication relay chain from Pwn2Own Berlin 2026, and no public exploit has been reported.
Narrow does not mean harmless. A single phished or reused password can turn an ordinary account into a way into other users’ mail. How serious that is for you depends on how many credentials in your tenant are already floating around.
Which Exchange Servers Need the CVE-2026-96940 Update
Four on-premises builds are affected. Confirm the fixed build against the KB article before relying on it.
| Product | Update | Fixed build |
|---|---|---|
| Exchange Server Subscription Edition RTM | KB5129955 | See the KB article |
| Exchange Server 2019 CU15 | KB5129956 | 15.02.1748.053 |
| Exchange Server 2019 CU14 | KB5129957 | 15.02.1544.048 |
| Exchange Server 2016 CU23 | KB5129958 | 15.01.2507.075 |
A server on an older cumulative update is not covered by these packages and has to move to a listed CU first.
Exchange Online was fixed on Microsoft’s side, so cloud-only tenants have nothing to do. Hybrid is different. The on-premises servers still need the update, and coverage of the Exchange Team’s guidance says that includes servers that only exist for management, plus machines running only the Exchange Management Tools.
Why Already Patched Servers Are Still Exposed
The Exchange Team’s release post says the only difference between the original September 2026 update and the V2 release is the addition of CVE-2026-96940. A server that took the original September package on Patch Tuesday looks fully patched in every inventory report and is still vulnerable to this one.
The release itself was messy. Microsoft acknowledged that the V2 update went out ahead of its intended schedule, and the Exchange SE package was reportedly visible through Windows Update for about a day before any release note appeared. If you saw an unexpected update on an SE server, this is probably what it was.
Install and Verify the Patch
Start by recording the current build on every Exchange server, from the Exchange Management Shell:
Get-Command ExSetup.exe | ForEach-Object { $_.FileVersionInfo }Code language: PHP (php)Compare the file version against the fixed build for your CU. If it is lower, the V2 update is missing.
Then install the package for your version. Run it with administrator rights from an elevated prompt and restart when asked. On a DAG member, put the server into maintenance mode first with StartDagServerMaintenance.ps1 from the Exchange Scripts folder, and bring it back with StopDagServerMaintenance.ps1 afterwards.
After the restart, run the Exchange Health Checker from the Exchange Management Shell. It lists the security updates installed on the server and is the quickest way to confirm the V2 build actually landed:
.\HealthChecker.ps1Code language: CSS (css)Repeat the ExSetup check as well, so the before and after numbers are in your change record.
Exchange 2016 and 2019 Without ESU
Support for Exchange 2016 and 2019 ended on October 14, 2025. Only organizations enrolled in the Period 2 Extended Security Update program, valid between May and October 2026, can get the updates released in that window, and Period 2 is a separate purchase even for customers who joined the first ESU period.
If you are not enrolled, you cannot obtain this patch. Microsoft’s guidance is to migrate to Exchange Server Subscription Edition to keep receiving security updates. For those organizations CVE-2026-96940 turns a migration that was planned for later into the actual remediation.
Reduce Exposure Until the Patch Is Installed
The update is the fix. The coverage I reviewed describes no configuration-only workaround for CVE-2026-96940, so anything below only lowers the odds that someone gets the valid login the attack needs.
I would patch the servers reachable from the internet first, since they see the most credential-guessing. Limit external exposure of OWA, ECP, EWS, and ActiveSync to what the business actually uses. Force password resets for accounts that appear in credential-leak reports, and review sign-in logs for logins from unusual locations.
Check the build number on every server today. The server that took the September update on time is the one most likely to be left behind, because it already looks patched.
Does CVE-2026-96940 affect Exchange Online?
No. Microsoft already fixed it in Exchange Online. Hybrid organizations still have to update their on-premises Exchange servers.
I installed the September 2026 Exchange update. Am I protected?
Not from this flaw. The original September update does not include the fix. Only the V2 release adds CVE-2026-96940.
Is CVE-2026-96940 being exploited in the wild?
Microsoft says it is not aware of active exploitation and that it found the issue internally. It does rate exploitation as more likely, so waiting for evidence of attacks is the wrong plan.
Can I get the fix for Exchange 2016 or 2019 without ESU?
No. Updates released between May and October 2026 for these versions go only to organizations enrolled in the Period 2 ESU program. Everyone else is directed to migrate to Exchange Server Subscription Edition.
How do I confirm the update installed?
Check the ExSetup file version against the fixed build for your CU, then run the Exchange Health Checker script, which lists the security updates installed on the server.
Read more: How To Windows Server 2016 Metadata Cleanup Best Way
References
Microsoft Exchange Team: Released: September 2026 V2 Exchange Server Security Updates https://techcommunity.microsoft.com/blog/exchange/released-september-2026-v2-exchange-server-security-updates/4561718
Microsoft Security Response Center: CVE-2026-96940 https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940
Microsoft CSS-Exchange: Exchange Health Checker https://aka.ms/ExchangeHealthChecker
Help Net Security: Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940) https://www.helpnetsecurity.com/2026/10/05/exchange-server-vulnerability-cve-2026-96940/
Cyber Security News: Microsoft Pushes New Exchange V2 Update After Discovering New Security Flaw https://cybersecuritynews.com/microsoft-reissues-exchange-server-update/
Franky’s Web: New security updates for Exchange Server (September 2026) V2 https://www.frankysweb.de/en/new-security-updates-for-exchange-server-september-2026-v2/
