Microsoft releases Exchange Server security updates for CVE-2026-96940

Microsoft has released V2 security updates for Exchange Server SE, Exchange 2019, and Exchange 2016 to address a critical vulnerability identified as CVE-2026-96940. This flaw involves an elevation of privilege in the authorization process.

An attacker with existing low-level user credentials could exploit this vulnerability over a network to escalate their rights. This would allow unauthorized access to the mailboxes, emails, and attachments of other users within the same organization. While the vulnerability carries a high CVSS score of 8.8, Microsoft has not confirmed any active exploitation in the wild.

Administrators must install these V2 updates even if they have already applied the original September security updates, as the V2 version is required to remediate this specific CVE. Security updates for Exchange 2019 and 2016 are specifically available to organizations enrolled in the Extended Security Update Period 2 program.