CVE-2026-96940

Undergoing Analysis Undergoing Analysis - In Progress

Weak Authorization in Microsoft Exchange Server

Publication date: 2026-10-02

Last updated on: 2026-10-08

Assigner: Microsoft Corporation

Description

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information. To exploit the vulnerability, an attacker could send a specially crafted email message containing a malicious link to a user. Alternatively, an attacker could use a chat client to social engineer a user into clicking the malicious link. The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests. Note: In order to exploit this vulnerability, a user must click a maliciously crafted link from an attacker.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-10-02

Last Modified

2026-10-08

Generated

2026-10-11

AI Q&A

2026-10-02

EPSS Evaluated

2026-10-09

NVD

CVE-2026-96940

EUVD

EUVD-2026-91771

Affected Vendors & Products

Vendor	Product	Version / Range
microsoft	exchange_server	*

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-1390	The product uses an authentication mechanism to restrict access to specific users or identities, but the mechanism does not sufficiently prove that the claimed identity is correct.

Attack-Flow Graph

Executive Summary

This vulnerability is a weak authorization issue in Microsoft Exchange Server that allows an authenticated attacker to gain higher privileges than intended over a network.

Detection Guidance

Detecting this vulnerability requires checking Microsoft Exchange Server configurations and logs for unauthorized privilege escalation attempts. Review Exchange admin audit logs for suspicious activity and verify that authorization controls are properly enforced. No specific commands are provided in the available resources.

Impact Analysis

An attacker could exploit this to gain elevated access to sensitive data or system functions, potentially leading to unauthorized data access, modification, or disruption of services.

Compliance Impact

This vulnerability could lead to unauthorized access to personal or sensitive data, violating compliance requirements under GDPR, HIPAA, or other regulations that mandate strict access controls and data protection.

Mitigation Strategies

Apply the latest security updates from Microsoft for Exchange Server as soon as possible to address the weak authorization issue.

Hi! I’m here to help you understand CVE-2026-96940. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70