Microsoft’s September 2026 V2 Exchange Server security updates fix CVE-2026-96940, an authenticated network privilege-escalation flaw. Administrators should check their on-premises Exchange product, cumulative update branch and build, then install the matching Microsoft update if eligible. Microsoft said on October 2, 2026, that it was not aware of active exploitation and recommended applying the update at the earliest opportunity.
What CVE-2026-96940 means for Exchange
NIST’s National Vulnerability Database describes CVE-2026-96940 as weak authorization in Microsoft Exchange Server that could let an authenticated attacker elevate privileges over a network. Microsoft’s CVSS 3.1 score, recorded by NIST, is 8.8 High, with vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H. NIST had not supplied a separate score when its record was reviewed. This is a privilege-escalation issue, not an unauthenticated remote-code-execution claim. NIST’s CVE-2026-96940 record
As an Amazon Associate I earn from qualifying purchases.
Help Net Security reports that the flaw could allow someone to read other users’ emails and attachments within the same organization, but not cross tenant boundaries. That is the outlet’s description of the practical mailbox risk; NIST’s accessible description is broader and identifies privilege escalation. Microsoft said it identified the vulnerability internally and was not aware of active exploitation as of its October 2 announcement. That statement describes Microsoft’s awareness at that time, not proof that exploitation is impossible or has never occurred. Help Net Security’s report · Microsoft Exchange Team announcement
Quick wins for a faster PC:
Fix the driver behind crashes, sound loss and screen glitchesFind Drivers →Clear out junk files and repair common Windows errorsFree Scan →Which Exchange Server builds are affected?
The affected ranges below are the versions below each listed corrected build. Check both the product branch and the installed build; a version number alone without its cumulative update context can lead to choosing the wrong package. NIST’s affected-version details
#1 Best Overall
| Exchange branch | Affected build range | Corrected build threshold |
|---|---|---|
| Exchange Server 2016 CU23 | Below 15.01.2507.075 | 15.01.2507.075 |
| Exchange Server 2019 CU14 | Below 15.02.1544.048 | 15.02.1544.048 |
| Exchange Server 2019 CU15 | Below 15.02.1748.053 | 15.02.1748.053 |
| Exchange Server Subscription Edition RTM | Below 15.02.2562.053 | 15.02.2562.053 |
These ranges do not establish that every Exchange installation is affected. Compare your server’s exact branch and build with the applicable threshold, then use Microsoft’s Security Update Guide and the update article for that release branch to identify the package.
Which V2 update applies, and can you get it?
Microsoft published the September 2026 V2 security updates on October 2. The Exchange Team said this V2 release adds CVE-2026-96940 to the prior September update. Microsoft’s support pages identify these packages:
- Exchange Server Subscription Edition RTM: KB5129955, labeled SU10V2. Microsoft Support: KB5129955
- Exchange Server 2019 CU14: KB5129957, labeled SU14V2. Microsoft Support: KB5129957
- Exchange Server 2019 CU15 and Exchange Server 2016 CU23: Microsoft lists releases for both branches in its V2 announcement. Select the KB matching the installed branch from Microsoft’s update guidance rather than applying a package for a different CU.
Eligibility matters for older releases. Microsoft states that Exchange Server 2016 and 2019 are out of support; organizations enrolled in Period 2 Extended Security Update (ESU) can obtain released updates until the end of October 2026. Microsoft advises organizations without ESU that need the latest security updates to migrate to Exchange Server Subscription Edition. Do not assume the 2016 or 2019 updates are available to every customer. Microsoft Support: KB5129957
PC Slower Than It Used to Be?
A free scan shows the junk files, broken settings and background clutter dragging Windows down - then fixes them in one click.Free scan · Windows 10 & 11Crashes, No Sound, or Screen Glitches?
Random freezes, missing sound and display glitches usually trace back to one bad driver. Find and replace yours safely.Free scan · under a minuteExchange Online customers are already protected from the vulnerabilities addressed by these security updates and do not need to patch the service. Microsoft says they should still update any Exchange servers or Exchange Management Tools workstations that remain in their environment. Microsoft Exchange Team announcement
Independent reader supportYour contribution helps us test, update, and keep practical guides available for everyone.How to install and verify the update
- Inventory the environment: identify each on-premises Exchange server’s product, cumulative update branch and installed build. Include servers and workstations running Exchange Management Tools.
- Confirm the matching release and eligibility: use Microsoft’s V2 announcement and the support article for the exact branch. For Exchange 2016 or 2019, confirm Period 2 ESU enrollment before relying on access to the update.
- Download the package from Microsoft: the standalone packages are available through the Microsoft Update Catalog or Download Center, as described in the applicable support article. For Exchange Server Subscription Edition RTM KB5129955, Microsoft lists the filename
ExchangeSubscriptionEdition-KB5129955-x64-en.exeand SHA-25640B3825435C072298896563DA623E288F79A9B913E2B674FFC7CA4A38547857F. Check Microsoft’s current package and hash listings before installing. Microsoft Support: KB5129955 - Install on servers and management-tools hosts: Microsoft recommends installing security updates on all Exchange Servers and all servers and workstations running Exchange Management Tools, to maintain compatibility between management-tools clients and servers. Follow the deployment guidance in the article for your package. Microsoft Exchange Team deployment guidance
- Validate the result: run Microsoft’s Exchange Server Health Checker to verify installation and identify any additional required actions. Microsoft Support: KB5129955
Microsoft recommends applying the update at the earliest opportunity, citing the potential for consistent exploitation and prior exploitation of this vulnerability type. The reviewed sources do not establish a count of affected organizations, an exploitation rate or a typical remediation time.
Quick Recap
Product prices and availability are accurate as of the date/time indicated and are subject to change. Any price and availability information displayed on Amazon at the time of purchase will apply.
