Exchange admins need September V2 patches for new privilege flaw

Feeds.4Sysops •IT News • October 3, 2026

Microsoft’s September V2 Exchange Server updates add a fix for CVE-2026-96940, a network-accessible privilege-escalation flaw that can expose other users’ mailboxes. The update builds on September’s Exchange fixes for remote-code execution and mailbox-takeover risks ; on-premises administrators should verify they have the V2 patches installed. Source

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Microsoft Exchange Server Vulnerability CVE-2026-96940 Disclosed On October 2, 2026, Microsoft disclosed CVE-2026-96940, a privilege escalation vulnerability in Microsoft Exchange Server. This flaw allows authenticated attackers to gain unauthorized access to other users' mailboxes within the same organization. The vulnerability has a CVSS score of 8.8, categorizing it as high severity. Microsoft has already deployed a fix for Exchange Online, and on-premises administrators are advised to install the September V2 patches to mitigate the risk. The vulnerability does not allow access across tenant boundaries. The patch is crucial as it builds on previous updates addressing remote code execution and mailbox takeover risks. Administrators should verify the installation of the V2 patches to ensure protection against this flaw. 2 sources 63

Extracted Entities

CVEs (1)

CVE-2026-96940