CVE-2026-96940

highpriority · attend · 46EPSS 0.027 · 86 %ileexploit · PoCDENLUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

2.75% (86th) EPSS

CVSS 8.8 · high

Is it mine?

20 products

Check your exposure

Who says so?

4 sources

cert_bund · msrc_csaf · ncsc_nl · nvd

EPSS · scored 2026-10-27

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

remediations

Vendor fix, mitigation, or workaround guidance, as published by each source.

A vendor fix is available.

FixedMicrosoft Exchange Server 2016 Cumulative Update 23msrc_csaf
15.01.2507.075:Security Update:https://support.microsoft.com/help/5129958
https://support.microsoft.com/help/5129958
FixedMicrosoft Exchange Server 2019 Cumulative Update 14msrc_csaf
15.02.1544.048:Security Update:https://support.microsoft.com/help/5129957
https://support.microsoft.com/help/5129957
FixedMicrosoft Exchange Server 2019 Cumulative Update 15msrc_csaf
15.02.1748.053:Security Update:https://support.microsoft.com/help/5129956
https://support.microsoft.com/help/5129956
FixedMicrosoft Exchange Server Subscription Edition RTMmsrc_csaf
15.02.2562.053:Security Update:https://support.microsoft.com/help/5129955
https://support.microsoft.com/help/5129955

cvss

Technical severity, 0–10. One row per scoring source.

8.8

010

base score 0–10 · higher = more severe · hover a vector to decode

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hprimary · secure@microsoft.com USexploitability 2.8 · impact 5.9

v3.18.3highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:Psecondary · CVSS-BT (t0sche)

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:Hsecondary · NCSC-NL NL

v3.18.8highCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:Csecondary · Microsoft Security Response Center US

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: no · Technical Impact: totalcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-1390USCWE-1390USCWE-1390USCWE-1390US

exploits (1)

Public proof-of-concept and weaponised exploit code.

HORKimhab/CVE-2026-96940CVE-2026-96940PoC · poc_in_github

affected products (20)

Products and version ranges known to be affected.

Microsoft Exchange Server 2016 Cumulative Update 23all versionscert_bundDEcpe:/a:microsoft:exchange:server_2016_cumulative_update_23
Microsoft Exchange Server 2019 Cumulative Update 14all versionscert_bundDEcpe:/a:microsoft:exchange:server_2019_cumulative_update_14
Microsoft Exchange Server 2019 Cumulative Update 15all versionscert_bundDEcpe:/a:microsoft:exchange:server_2019_cumulative_update_15
Microsoft Exchange Server Subscription Edition RTMall versionscert_bundDEcpe:/a:microsoft:exchange:server_subscription_edition_rtm
Microsoft Microsoft Exchange Server 2016 Cumulative Update 23all versionsfixedmsrc_csafUS
Microsoft Microsoft Exchange Server 2016 Cumulative Update 23< 15.01.2507.075msrc_csafUS
Microsoft Microsoft Exchange Server 2019 Cumulative Update 14all versionsfixedmsrc_csafUS
Microsoft Microsoft Exchange Server 2019 Cumulative Update 14< 15.02.1544.048msrc_csafUS
Microsoft Microsoft Exchange Server 2019 Cumulative Update 15all versionsfixedmsrc_csafUS
Microsoft Microsoft Exchange Server 2019 Cumulative Update 15< 15.02.1748.053msrc_csafUS
Microsoft Microsoft Exchange Server Subscription Edition RTMall versionsfixedmsrc_csafUS
Microsoft Microsoft Exchange Server Subscription Edition RTM< 15.02.2562.053msrc_csafUS
Microsoft Exchange≤ vers:unknown/*ncsc_nlNL
Microsoft Microsoft Exchange Server 2016 Cumulative Update 23≤ vers:unknown/*ncsc_nlNL
Microsoft Microsoft Exchange Server 2019 Cumulative Update 14≤ vers:unknown/*ncsc_nlNL
Microsoft Microsoft Exchange Server 2019 Cumulative Update 15≤ vers:unknown/*ncsc_nlNL
Microsoft Microsoft Exchange Server Subscription Edition RTM≤ vers:unknown/*ncsc_nlNL
microsoft exchange server= 2016nvdUScpe:2.3:a:microsoft:exchange_server:*:*:*:*:*:*:*:*
microsoft exchange server= 2019nvdUScpe:2.3:a:microsoft:exchange_server:*:*:*:*:*:*:*:*
microsoft exchange server subscription edition< 15.02.2562.053nvdUScpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:*

advisories (4)

Vendor and ecosystem advisories describing this.

NCSC-2026-0401Kwetsbaarheid verholpen in Microsoft Exchange ServerNL2026-10-06csaf · ncsc_nlNL
Microsoft heeft out-of-band, vooruitlopend op de maandelijkse update voor oktober, een kwetsbaarheid verholpen in Microsoft Exchange Server.
NCSC-2026-0419Kwetsbaarheden verholpen in Microsoft Excange ServerNL2026-10-13csaf · ncsc_nlNL
Microsoft heeft kwetsbaarheden verholpen in Exchange.
WID-SEC-W-2026-3718Microsoft Exchange Server: Schwachstelle ermöglicht PrivilegieneskalationDeutsch2026-10-04csaf · cert_bundDE
Ein entfernter, authentisierter Angreifer kann eine Schwachstelle in Microsoft Exchange Server ausnutzen, um seine Privilegien zu erhöhen, wodurch er Zugriff auf die Postfächer anderer Benutzer innerhalb derselben Organisation erhält und E-Mail-Nachrichten sowie Anhänge lesen kann.
msrc_CVE-2026-96940Microsoft Exchange Server Elevation of Privilege Vulnerability2026-10-02csaf · msrc_csafUS
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle

sources

Which sources assert this record, and when.

cert_bund msrc_csaf ncsc_nl nvd NVD CVE.org MITRE

published 2026-10-02modified 2026-10-15

references (1) nvd

External citations — patches, advisories, analysis.

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940PatchVendor Advisory

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan