CVE-2026-96940
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
- Published Oct 2, 2026
- CVSS 8.8 high
- 0.5% chance of exploitation in the next 30 days (EPSS)
Affected software
In the news
- Microsoft security advisory (AV26-1001) Canadian Centre for Cyber Security ·
- Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes The Hacker News ·
- Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940) Help Net Security ·
- Vulnerability in Microsoft Exchange Server CERT-FR ·