Zero Day MonitorZDM
DashboardVulnerabilitiesTrendingZero-DaysNewsAbout
Login
ImpressumPrivacy Policy
Zero Day Monitor © 2026
5755 articles · 234019 vulns · 35/41 feeds (7d)
← Back to list
8.8
CVE-2026-96940PATCHED
Microsoft · Microsoft Exchange Server 2016 Cumulative Update 23

Microsoft Exchange Server Elevation of Privilege Vulnerability

Description

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Affected Products

VendorProductVersions
MicrosoftMicrosoft Exchange Server 2016 Cumulative Update 2315.01.0.0, 15.02.0.0, 15.02.0.0, 15.02.0.0

Also Affects

Downstream vendors/products affected by this vulnerability

VendorProductSourceConfidence
microsoftmicrosoft exchange server 2019 cumulative updatemitre_affected90%
microsoftmicrosoft exchange server subscription edition rtmmitre_affected90%
microsoftexchangecert_advisory90%

References

  • https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940(vendor-advisory, patch)

Related News (9 articles)

Tier D
Help Net Security2d ago
Week in review: FortiBleed is still active, Patch Tuesday forecast
→ No new info (linked only)
Tier B
CCCS Canada8d ago
Microsoft security advisory (AV26-1001)
→ No new info (linked only)
Tier D
The Hacker News8d ago
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
→ No new info (linked only)
Tier D
Help Net Security8d ago
Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940)
→ No new info (linked only)
Tier B
BSI Advisories8d ago
[NEU] [hoch] Microsoft Exchange Server: Schwachstelle ermöglicht Privilegieneskalation
→ No new info (linked only)
Tier D
Heise Security8d ago
Microsoft schiebt Exchange-Update nach
→ No new info (linked only)
Tier B
CERT-FR8d ago
Vulnérabilité dans Microsoft Exchange Server (05 octobre 2026)
→ No new info (linked only)
Tier C
VulDB11d ago
CVE-2026-96940 | Microsoft Exchange Server improper authorization
→ No new info (linked only)
Tier A
Microsoft MSRC11d ago
CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege Vulnerability
→ No new info (linked only)

Discussion (0)

Loading…

CVSS 3.18.8 HIGH
VectorCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CISA KEV❌ No
Actively exploited❌ No
Patch available
15.01.2507.07515.02.1544.04815.02.1748.05315.02.2562.053
CWECWE-1390
PublishedOct 2, 2026
Last enriched11d ago
Trending Score48
Source articles9
Independent8
Info Completeness7/14
Missing: title, description, epss, kev, exploit, iocs, mitre_attack

Community Vote

0
Login to vote
0 upvotes0 downvotes
No votes yet

Related CVEs (5)

HIGHCVE-2026-96951EXPKEV
Windows Shell Security Feature Bypass Vulnerability
Trending: 132
HIGHCVE-2026-81963EXPKEV
Windows Update Stack Elevation of Privilege Vulnerability
Trending: 82
HIGHCVE-2026-85880EXPKEV
Windows Advanced Local Procedure Call (ALPC) Elevation of Privilege Vulnerability
Trending: 82
CRITICALCVE-2026-88131
Microsoft Dataverse Remote Code Execution Vulnerability
Trending: 64
CRITICALCVE-2026-77900
Azure App Service Remote Code Execution Vulnerability
Trending: 64

Pin to Dashboard

Verification

State: verified
Confidence: 0%

Vulnerability Timeline

CVE Published
Oct 2, 2026
Discovered by ZDM
Oct 2, 2026
Patch Available
Oct 13, 2026