AETERNAE AI RESEARCH LLC INDEPENDENT RESEARCH
ÆAETERNAERESEARCH
Sign inRequest access
← CVE index
Δ / VULNERABILITY RECORD

CVE-2026-96940.

Source-reported disclosure and enrichment record.

SEVERITY / CVSSHIGH / 8.8CVSS 3.1 · secure@microsoft.com
EXPLOITATION STATUSNot listed in the cached KEV catalogThis does not establish absence of exploitation.
RECORD STATUSAwaiting AnalysisModified Oct 06, 2026

Disclosure summary

Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.

Source-reported weakness categories

CWE-1390

Source-specific records & product guidance

Sources retain their own attribution and scoring. Follow the original record to confirm affected versions, fixed releases, and configuration conditions.

NIST National Vulnerability Database · NVD-CVE-2026-96940

Open original source · Updated Oct 06, 2026

Only CPE matches marked vulnerable=true are indexed. AND/OR platform conditions must be checked in the original NVD record.

MSRC Security Update Guide · RSS-d051f6e23e55810613d46caf202f8b77513

Open original source · Updated Oct 02, 2026

CVE-2026-96940 Microsoft Exchange Server Elevation of Privilege Vulnerability

CVE mention in publisher metadata; check the original affected versions.

Microsoft Security Updates (CVRF) · 2026-Oct

Open original source · Updated Oct 02, 2026

Microsoft Exchange Server Elevation of Privilege Vulnerability

Maximum of vendor-reported product scores; products and fixed builds are associations, not a universal affected-version statement.

Microsoft maximum product score: 8.8

VendorProduct / associationVersion / bounds
Microsoft update guideMicrosoft Exchange Server 2019 Cumulative Update 14 (MSRC status code 3)
Microsoft update guideMicrosoft Exchange Server 2016 Cumulative Update 23 (MSRC status code 3)
Microsoft update guideMicrosoft Exchange Server Subscription Edition RTM (MSRC status code 3)
Microsoft update guideMicrosoft Exchange Server 2019 Cumulative Update 15 (MSRC status code 3)

Vendor remediation references

  • 5129957 · build 15.02.1544.048 · product IDs 12293
  • Vendor guidance · product IDs 12293
  • 5129958 · build 15.01.2507.075 · product IDs 12039
  • Vendor guidance · product IDs 12039
  • 5129955 · build 15.02.2562.053 · product IDs 16792
  • Vendor guidance · product IDs 16792
  • 5129956 · build 15.02.1748.053 · product IDs 12502
  • Vendor guidance · product IDs 12502

Original records & references

PUBLISHED 2026-10-02T15:16:43-04:00
MODIFIED 2026-10-06T11:05:34-04:00
INGESTED 2026-10-06T11:45:30-04:00