CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability
Microsoft Exchange Server Elevation of Privilege Vulnerability
Other sources
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
— Microsoft
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.01.2507.075Patch KB5129958 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.2562.053Patch KB5129955 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1748.053Patch KB5129956 - Upgrade
Upgrade to a fixed release to a version that resolves this vulnerability.
Fixed in 15.02.1544.048Patch KB5129957
Event History
Frequently Asked Questions
What level of access does an attacker need to exploit this issue?
The attacker must already be authenticated and able to reach the affected Exchange Server over the network. No user interaction is required.
What could an attacker gain through successful exploitation?
Successful exploitation can allow privilege elevation. The reported impact includes high confidentiality, integrity, and availability impact.
Which Exchange Server releases are listed as affected?
The listed products are Microsoft Exchange Server 2016, Microsoft Exchange Server 2019, Microsoft Exchange Server Subscription Edition RTM, and Microsoft Exchange Server.