CVE-2026-96940

Analyzed Analyzed - Analysis Complete

BaseFortify

Publication date: 2026-10-02

Last updated on: 2026-10-15

Assigner: Microsoft Corporation

Description

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-15

Generated

2026-10-19

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-18

NVD

CVE-2026-96940

EUVD

EUVD-2026-91771

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	exchange_server	2016
microsoft	exchange_server	2019
microsoft	exchange_server	2019
microsoft	exchange_server_subscription_edition	to 15.02.2562.053 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1390	The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is a weak authorization issue in Microsoft Exchange Server that allows an authenticated attacker to gain higher privileges than intended over a network.

Detection Guidance

Detecting this vulnerability requires checking Microsoft Exchange Server configurations and logs for unauthorized privilege escalation attempts. Review Exchange admin audit logs for suspicious activity and verify that authorization controls are properly enforced. No specific commands are provided in the available resources.

Impact Analysis

An attacker could exploit this to gain elevated access to sensitive data or system functions, potentially leading to unauthorized data access, modification, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations that mandate strict access controls and data protection.

Mitigation Strategies

Apply the latest security updates from Microsoft for Exchange Server as soon as possible to address the weak authorization issue.

Hi! I’m here to help you understand CVE-2026-96940. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70