CVE-2026-96940 | defend.network

What is CVE-2026-96940?

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

CVSS8.8 NVD 3.1

SeverityHIGH

ExploitationNo exploitation reported

EPSS<1% · P40

Triage statusNo Known Exploit

ActionPatch this week

CVSS vectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CWECWE-1390

NVD published2026-10-02

NVD last modified2026-10-03

Timeline

2026-10-02Published to the U.S. National Vulnerability Database (NVD)
2026-10-03NVD record last updated
2026-10-06First covered in a defend.network daily briefing

Affected product

See advisory

Remediation Steps

Deploy Microsoft out-of-band Exchange Server security updates immediately to all affected systems
Focus on systems in environments with high-value mailbox targets (executive, finance, legal, healthcare)
Audit mailbox access logs for unauthorized cross-user access patterns since vulnerability disclosure
Restrict Exchange Server access via network segmentation where possible
Reset credentials for administrative and service accounts post-patch

References

Referenced in our briefings & reports

Vulnerability Priority Report – Week 1 of October 2026 (October 5 – 11)
Rejetto HFS, MS Exchange, Dell System Update under active exploitation (2026-10-06)

Browse all tracked CVEs in the defend.network CVE database →

🤖 This CVE page is generated by defend.network from NVD, CISA KEV, EPSS, and our verified daily briefings. Severity and exploitation data come from official sources; always verify remediation steps against the official vendor advisory before acting in production.