PT-2026-104421 · Microsoft · Exchange Server 2016+2
CVE-2026-96940
·
Published
2026-10-02
·
Updated
2026-10-03
CVSS v3.1
8.8
High
| Vector | AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
Name of the Vulnerable Software and Affected Versions
Microsoft Exchange Server SE (affected versions not specified)
Microsoft Exchange Server 2019 (affected versions not specified)
Microsoft Exchange Server 2016 (affected versions not specified)
Description
Weak authorization allows an authenticated attacker to elevate privileges over a network. This issue enables any user with a valid login to escalate their privileges.
Recommendations
Install the September 2026 V2 security updates for Microsoft Exchange Server SE.
Install the September 2026 V2 security updates for Microsoft Exchange Server 2019.
Install the September 2026 V2 security updates for Microsoft Exchange Server 2016 via Period 2 ESU.
Fix
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Exchange Server 2016
Exchange Server 2019
Exchange Server