Exchange Server: out-of-band patch for CVE-2026-96940

On Friday 2 October 2026 Microsoft published a security bulletin on CVE-2026-96940, an elevation of privilege vulnerability in Microsoft Exchange Server. The release came outside the usual monthly second-Tuesday schedule, which in October falls on the 13th.

On 5 October the CERT-FR (CERTFR-2026-AVI-1258) and the Canadian Centre for Cyber Security (AV26-1001) published advisories, followed on 6 October by the NCSC-NL (NCSC-2026-0401). The affected versions listed by the agencies match.

What happened

According to the CERT-FR, the vulnerability allows an attacker to gain elevated privileges on Exchange Server. Microsoft describes it as “Microsoft Exchange Server Elevation of Privilege Vulnerability”. The NCSC-NL rated its advisory M/H, meaning medium likelihood and high impact.

The CERT-FR refers to the vendor bulletin for the fixes; the Canadian Centre encourages administrators and users to review the bulletin and apply the necessary updates.

Technical details

• CVE: CVE-2026-96940.
• Flaw type: elevation of privilege.
• Vendor bulletin: Microsoft Security Update Guide, 2 October 2026.
• Affected versions (all builds below the one shown, according to the CERT-FR and the Canadian Centre):
  • Exchange Server 2016 Cumulative Update 23: builds below 15.01.2507.075;
  • Exchange Server 2019 Cumulative Update 14: builds below 15.02.1544.048;
  • Exchange Server 2019 Cumulative Update 15: builds below 15.02.1748.053;
  • Exchange Server Subscription Edition RTM: builds below 15.02.2562.053.
• MITRE ATT&CK: exploiting a vulnerability to gain higher privileges generally maps to T1068 (Exploitation for Privilege Escalation).

The available advisories do not state the CVSS score, the attack vector, whether credentials are needed to exploit the flaw or whether it is already being exploited. Nor do they include indicators of compromise. For these details, Microsoft’s bulletin is the reference, and it is worth checking again over the coming days for updates.

The agencies list only these four branches. If a server runs a different cumulative update, no fixed build is given for it: check Microsoft’s bulletin for how to bring it to an updated version.

Impact for European and Italian companies

An on-premises Exchange Server holds the whole organisation’s mail and is often integrated with Active Directory. This is why an elevation of privilege on these servers deserves attention even when, as in this case, exploitation details are still missing: the NCSC-NL rating points to potentially high impact.

The issue also concerns organisations that have moved mailboxes to Microsoft 365 but keep an on-premises Exchange server to manage a hybrid environment: that server needs updating too.

For entities in scope of NIS2 (in Italy, Legislative Decree 138/2024), vulnerability handling is part of the required security measures: applying the update and recording when and on which servers it was done helps demonstrate it. If signs of compromise were to emerge, the incident must be assessed for notification to the national CSIRT, which in Italy is CSIRT Italia at the ACN.

What to do now

1. Inventory: identify every on-premises Exchange server, including test servers and those kept only to manage the hybrid environment.

2. Check the build of each server. From the Exchange Management Shell, the command Microsoft documents for reading the installed build, security updates included, is:

   Get-Command Exsetup.exe | ForEach-Object { $_.FileVersionInfo }

   Compare the value with the build shown for your branch in the technical details list: if it is lower, the server is vulnerable.

3. Update with the package listed in Microsoft’s bulletin, one server at a time if you run a database availability group, starting with those reachable from the Internet. Microsoft recommends installing Exchange security updates from a session with administrator privileges.

4. Check the build again after installation and verify that Outlook on the web and mail flow work.

5. General checks, while technical details are pending: the advisories give no indicators to look for, but you can review recent administrative changes with Search-AdminAuditLog, new members of privileged role groups (such as Organization Management) and recently added mailbox permissions.

6. Follow the updates: if Microsoft or the agencies report active exploitation, the priority rises and indicators to search for in the logs may follow.

How ARXDOME helps

ARX Shield lists open vulnerabilities by machine and by package on monitored machines, highlighting those already exploited, and shows their age: it helps keep track of servers still waiting for the update. ARX Expose shows which services your company exposes on the Internet and which products are recognised on them, useful to know whether an Exchange server is reachable from outside. ARX Sentry, in the SOC pages dedicated to identities, shows privileged logons and account changes.

Last updated: 6 October 2026