CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
Other sources
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
— Microsoft
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
— Microsoft
Affected Software
Remediation
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must already be authenticated and able to reach the affected Exchange Server over the network. No user interaction is required.
What could an attacker gain through successful exploitation?
Successful exploitation can allow privilege elevation. The reported impact includes high confidentiality, integrity, and availability impact.
Which Exchange Server releases are listed as affected?
The listed products are Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, Microsoft Exchange Server Subscription Edition RTM, and Microsoft Exchange Server.