On October 2, 2026, Microsoft published an advisory for CVE-2026-96940, an elevation of privilege vulnerability in Exchange Server, and followed it with an out-of-band release it calls the September 2026 V2 security updates. The flaw comes from weak authorization: an attacker who already holds a valid account in your organization can elevate privileges over the network and read the mailboxes of other users in the same organization, including their email messages and attachments. No user interaction is required, and Microsoft states the flaw does not allow access across tenant boundaries.
The vulnerability is rated Important and carries a CVSS base score of 8.8, with the attack path spelled out in the vector: network reachable, low complexity, low privileges required, no user interaction, and high impact on confidentiality, integrity and availability. Microsoft discovered the issue internally, credited its own researcher Jan Mitchell with the find, says it is not aware of active exploitation, and has not seen public disclosure of technical details. At the same time, the company tagged the flaw with an exploitation assessment of “Exploitation More Likely,” which is Microsoft’s way of saying that attackers tend to weaponize this class of bug and administrators should not wait for the next scheduled patch cycle.
What One Compromised Account Can Become
The authentication requirement is the most misunderstood part of this advisory. It does not mean the flaw is harmless. It means the prerequisite is one working credential, and working credentials are exactly what phishing operations produce at industrial scale. A single harvested password, a malicious insider, or an account taken over through a separate malware infection is enough to satisfy the condition and start reading other people’s mail.
The target is rich. Exchange mailboxes hold password reset messages, invoices, contract negotiations, HR discussions and executive correspondence. An attacker who can quietly read the mailbox of a finance clerk or a VP has a head start on every business email compromise that follows, without sending a single suspicious message that a gateway could catch. That is why mailbox confidentiality, not server uptime, is the real stakes here.
A Rollout That Surprised Administrators
The release sequence was unusual. Microsoft deployed a related service-side fix to Exchange Online in the last week of September, before the security updates were accompanied by a KB article explaining their content, which took administrators by surprise. The Exchange Server team later acknowledged that the update was published ahead of its intended schedule, though it did not explain why that happened. Exchange Online customers are already protected by the service-side fix and do not need to take action, but organizations with hybrid deployments still have to patch their local servers, including servers used only for management, and workstations running the Exchange Management Tools.
Who Needs To Act, and With Which Package
The September 2026 V2 update adds protection for CVE-2026-96940 on top of the original September security updates, so organizations that installed the earlier release must install this one too. The packages and fixed builds per product are:
- Exchange Server Subscription Edition RTM: KB5129955, fixed build 15.02.2562.053
- Exchange Server 2019 Cumulative Update 15: KB5129956, fixed build 15.02.1748.053
- Exchange Server 2019 Cumulative Update 14: KB5129957, fixed build 15.02.1544.048
- Exchange Server 2016 Cumulative Update 23: KB5129958, fixed build 15.01.2507.075
There is an uncomfortable footnote for anyone still on Exchange 2016 or 2019. Both versions are out of mainstream support, and their latest patches are available only through the Period 2 Extended Security Update program, which covers May through October 2026, requires a separate purchase, and will not be extended again. After October, the only supported path for current security updates is Exchange Server Subscription Edition.
Microsoft recommends running the Health Checker script to identify missing updates and manual actions, installing the matching package on all servers, restarting, and confirming Exchange services come back healthy. The release does list known issues, including HTTP 500 errors on published calendar files and ContentEngine deadlocks affecting Korean language email, so plan your maintenance window accordingly.
Why DMARC Belongs in This Conversation
It is fair to ask what a mailbox read vulnerability has to do with domain authentication. The answer is that the two threats feed each other. The credential that unlocks CVE-2026-96940 is often stolen through spoofed email, and enforced DMARC is one of the cheapest, most effective ways to make those spoofs of your domain bounce at the receiver. A p=reject policy means a receiver refuses a message claiming to be from your domain unless it genuinely came from infrastructure you authorize, which removes the most common impersonation shortcut from the picture.
There is a second, subtler link. If an attacker escalates from a read-only position to control of a mailbox that sends mail, their messages will pass SPF, DKIM and DMARC legitimately, because they really are using your infrastructure. DMARC aggregate reports are one of the few places where that shows up early. A new sending source, an authentication result that changed without a corresponding change you made, or volume anomalies in your reports are exactly the signals that surface a compromised internal component, provided someone is actually reading them.
What This Means for Your Program
Patch first, this week. An out-of-band release with an “Exploitation More Likely” assessment is not a drill. Identify every on-premises Exchange server, including hybrid and management-only servers, apply the matching V2 package, and verify the fixed build number.
Treat valid credentials as the perimeter. The flaw’s only prerequisite is an authenticated account. Enforce multi-factor authentication, hunt for stale credentials, and make password reset email a protected asset rather than a routine notification.
Keep DMARC at enforcement, not just published. A record with p=none observes but does not protect. Domains that reach and hold p=reject remove the easiest spoofing path that produces the stolen credentials this flaw requires.
Watch aggregate reports during and after patching. Any unexpected sending source or shift in authentication results while you are working an incident deserves a second look, because reports are the telemetry layer that sees your own infrastructure misbehaving.
The Takeaway
CVE-2026-96940 is not the loudest vulnerability of the month, but it is a textbook example of how modern email attacks chain together. One phished credential becomes the key to other people’s mailboxes, and the intelligence gathered there becomes the next business email compromise. Patch your servers before the chain gets that far, and keep your domain’s authentication posture strong enough that the first link never forms.
Every email attack leaves a trace in your authentication data. Excello Mail turns your DMARC, SPF and DKIM signals into a live view of what your domain is really doing, so new sending sources and anomalies stand out immediately. Sign up for free to Excello Mail and see what your domain has been telling the world.