CVE-2026

Api.Msrc.Microsoft • October 2, 2026

We use optional cookies to improve your experience on our websites, such as through social media connections, and to display personalized advertising based on your online activity. If you reject optional cookies, only cookies necessary to provide you the services will be used. You may change your selection by clicking “Manage Cookies” at the bottom of the page. Privacy Statement Third-Party Cookies

Released: Oct 2, 2026

Please see Common Vulnerability Scoring System for more information on the definition of these metrics.

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

The following table provides an exploitability assessment for this vulnerability at the time of original publication.

Is Exchange Online affected, and do Exchange Online customers need to take action?

Microsoft has already deployed a related service-side fix to Exchange Online. Exchange Online customers do not need to take any action to receive the fix. Customers using affected on-premises Microsoft Exchange Server products should install the applicable security updates listed in the Security Updates table.

Where can I find more information?

Please see the Exchange blog for more information.

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An authenticated attacker who successfully exploited this vulnerability could gain unauthorized access to other users' mailboxes within the same organization and read email messages and attachments. The vulnerability does not allow access across tenant boundaries.

Jan Mitchell from Microsoft

To determine the support lifecycle for your software, see the Microsoft Support Lifecycle .

Information published.

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Exchange Server Vulnerability CVE-2026-96940 Disclosed On October 2, 2026, Microsoft disclosed CVE-2026-96940, a privilege escalation vulnerability in Microsoft Exchange Server. This flaw allows authenticated attackers to gain unauthorized access to other users' mailboxes within the same organization. The vulnerability has a CVSS score of 8.8, categorizing it as high severity. Microsoft has already deployed a fix for Exchange Online, and on-premises administrators are advised to install the September V2 patches to mitigate the risk. The vulnerability does not allow access across tenant boundaries. The patch is crucial as it builds on previous updates addressing remote code execution and mailbox takeover risks. Administrators should verify the installation of the V2 patches to ensure protection against this flaw. 2 sources 63

Extracted Entities

CVE-2026

The full story

Extracted Entities

Attack Types (1)

CWE Weaknesses (1)

MITRE ATT&CK (1)

Platforms (2)