CVE-2026-96940

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2026-96940
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required LOW

User Interaction NONE

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940 Patch Vendor Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:*
History

15 Oct 2026, 02:35

Type Values Removed Values Added
CPE cpe:2.3:a:microsoft:exchange_server:2016:cumulative_update_23:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_15:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server_subscription_edition:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:exchange_server:2019:cumulative_update_14:*:*:*:*:*:*
First Time Microsoft exchange Server Subscription Edition
Microsoft
Microsoft exchange Server
References () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940 - () https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940 - Patch, Vendor Advisory

13 Oct 2026, 19:22

Type Values Removed Values Added
Summary (en) An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information. To exploit the vulnerability, an attacker could send a specially crafted email message containing a malicious link to a user. Alternatively, an attacker could use a chat client to social engineer a user into clicking the malicious link. The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests. Note: In order to exploit this vulnerability, a user must click a maliciously crafted link from an attacker. (en) Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

08 Oct 2026, 23:17

Type Values Removed Values Added
Summary (en) Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network. (en) An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information. To exploit the vulnerability, an attacker could send a specially crafted email message containing a malicious link to a user. Alternatively, an attacker could use a chat client to social engineer a user into clicking the malicious link. The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests. Note: In order to exploit this vulnerability, a user must click a maliciously crafted link from an attacker.

02 Oct 2026, 19:16

Type Values Removed Values Added
New CVE
Information

Published : 2026-10-02 19:16

Updated : 2026-10-15 02:35

NVD link : CVE-2026-96940

Mitre link : CVE-2026-96940

CVE.ORG link : CVE-2026-96940

JSON object : View

Products Affected

microsoft

  • exchange_server
  • exchange_server_subscription_edition
CWE
CWE-1390

Weak Authentication