Microsoft Releases Early Exchange Server Security Updates for CVE-2026-96940: What Admins Should Do

Microsoft released early Exchange Server security updates for CVE-2026-96940. See affected versions, exact KBs and builds, known issues, and practical deployment checks.

Reader ratingRate this article

Loading reader rating…

Privacy-conscious voting uses a signed random browser identifier and a short-lived network hash; the rating tables contain no raw IP-address column.

A secured on-premises email server rack protected by a glowing shield and envelope symbol, with one amber warning light.
Original editorial illustration created for The IT Guys. It represents on-premises email-server security; it is not a Microsoft interface.

Microsoft released early, out-of-band Exchange Server security updates on October 2, 2026, for CVE-2026-96940, an Important elevation-of-privilege vulnerability in affected on-premises Exchange servers. This is not Patch Tuesday, not a Windows desktop update, and not a macOS update.[1]

Reporting cutoff: October 2, 2026 at 7:05 p.m. EDT (23:05 UTC). This report is a point-in-time review of Microsoft’s October 2026 CVRF, all four Exchange KB pages, current Windows release-health tables, and Apple’s release surfaces.

The short version

  • On-premises Exchange admins: identify the exact Exchange version and cumulative update, obtain the matching V2 package, and deploy it through an approved maintenance process.[1]
  • Exchange Online: Microsoft says it already deployed the related service-side fix; Exchange Online customers do not need to take action to receive it.[1]
  • Risk: a successfully authenticated attacker could read other users’ email and attachments inside the same organization; Microsoft says the flaw does not allow access across tenant boundaries.[1]
  • Exploit status: Microsoft records the flaw as not publicly disclosed and not exploited at the cutoff, while rating exploitation “More Likely.”[1]
  • Home users: ordinary Windows PCs, Macs, and Outlook clients do not install these Exchange Server packages.[1]

What CVE-2026-96940 can do

Microsoft describes CVE-2026-96940 as weak authorization that lets an authenticated attacker elevate privileges over a network. The CVSS 3.1 base score is 8.8, with a network attack vector, low attack complexity, low privileges required, and no user interaction required.[1]

The practical confidentiality risk is mailbox access: Microsoft says successful exploitation could let an authenticated attacker gain unauthorized access to other users’ mailboxes in the same organization and read messages and attachments. The vendor explicitly says the vulnerability does not cross tenant boundaries.[1]

How we know: Microsoft’s CVRF labels the severity Important, lists CVSS 8.8, records “Publicly Disclosed: No” and “Exploited: No,” and assesses exploitation as “More Likely.” “Not exploited” here is Microsoft’s point-in-time status, not proof that exploitation can never occur.[1]

Affected and not affected

Product or deviceStatusWhat to do
Exchange Server Subscription Edition RTMAffected on premisesInstall KB5129955 V2 and verify build 15.02.2562.053.[1][2]
Exchange Server 2019 CU15Affected; ESU eligibility requiredInstall KB5129956 V2 and verify build 15.02.1748.053.[1][3]
Exchange Server 2019 CU14Affected; ESU eligibility requiredInstall KB5129957 V2 and verify build 15.02.1544.048.[1][4]
Exchange Server 2016 CU23Affected; ESU eligibility requiredInstall KB5129958 V2 and verify build 15.01.2507.075.[1][5]
Exchange OnlineService-side fix deployedNo customer action is required to receive Microsoft’s cloud fix.[1]
Ordinary Windows PCs, Macs, and Outlook clientsNot targets for these server packagesDo not download or install an Exchange Server KB on a client computer.
Other or older Exchange buildsNot covered by the four fixed-build rowsDo not infer safety. Move to an eligible supported or ESU path before applying a package.

KB and fixed-build table

Exchange branchV2 updateFixed buildPackage label
Subscription Edition RTMKB512995515.02.2562.053SE RTM SU10V2[2]
2019 CU15KB512995615.02.1748.053CU15 SU11V2[3]
2019 CU14KB512995715.02.1544.048CU14 SU14V2[4]
2016 CU23KB512995815.01.2507.075CU23 SU25V2[5]

Microsoft’s CVRF says a restart is not required, but it also marks customer action as required. Treat “no restart required” as package metadata, not a promise of zero service interruption: use a maintenance window, follow Microsoft’s Exchange servicing instructions, and verify health after installation.[1]

Each October 2 KB is explicitly labeled version 2 and lists CVE-2026-96940 plus eight additional CVEs on the V2 pages: CVE-2026-55007, CVE-2026-69355, CVE-2026-69356, CVE-2026-69361, CVE-2026-69375, CVE-2026-69378, CVE-2026-69382, and CVE-2026-69641.[2][3][4][5]

Exchange 2016 and 2019 need valid ESU coverage

Exchange Server 2016 and 2019 are out of support. Microsoft says organizations enrolled in the Period 2 Extended Security Update program can receive released security updates through the end of October 2026; organizations without that coverage should migrate to Exchange Server Subscription Edition.[3][4][5]

Known issues and fixes included

  • All four V2 packages: Microsoft lists a known issue in which a published calendar .ics request can return HTTP 500 to calendar applications.[2][3][4][5]
  • Subscription Edition additionally: Microsoft lists delegated-mailbox free/busy failures in hybrid deployments that use Graph API only, plus a ContentEngine deadlock caused by missing Korean WordBreaker rule files.[2]
  • Resolved in all four packages: the KB pages say the update resolves wrapper messages appearing in a shared mailbox in hybrid environments after the June 2026 security update.[2][3][4][5]
  • Resolved in Subscription Edition: Microsoft also lists a fix for hybrid free/busy through Microsoft Graph incorrectly shifting busy times by the requester’s time zone.[2]

Business and administrator action plan

  1. Inventory before downloading. Record each server’s Exchange edition, CU, installed build, role, hybrid status, and ESU entitlement.[1]
  2. Choose the exact package. Match the server to KB5129955, KB5129956, KB5129957, or KB5129958; do not substitute a package from another CU.[1]
  3. Read the known issues. Identify published-calendar workflows, delegated mailbox free/busy, Graph-only hybrid dependencies, and Korean-language content indexing that need focused tests.[2]
  4. Protect recovery paths. Confirm current, usable backups and document rollback and escalation ownership before changing production email infrastructure.[2]
  5. Deploy through a maintenance window. Follow Microsoft’s Exchange update packaging and installation guidance even though the CVRF says no restart is required.[1]
  6. Verify the result. Confirm the fixed build, then run Microsoft’s Exchange Server Health Checker, review services and queues, test internal and external mail flow, and test OWA/ECP and hybrid functions used by the organization.[2]
  7. Monitor after change. Watch logs, help-desk reports, calendar publishing, shared mailboxes, and free/busy behavior before closing the change.[2]

What home users should do

If you use Outlook, Apple Mail, a phone, or a web browser to read email, you do not install these server packages on your device. If your mailbox is hosted in Exchange Online, Microsoft says the service-side fix is already deployed. If your employer runs Exchange on premises, the server administrator or managed-service provider handles the update.[1]

Do not trust an email attachment, pop-up, or search advertisement that offers an “Exchange security patch” for your PC. Administrators should obtain packages through Microsoft’s official KB, Download Center, or Update Catalog links.[2]

Why this is not a Windows or Mac update

Microsoft named this release “October 2026 Early Security Updates,” and its one CVE belongs to Microsoft Exchange Server. The Windows Message Center’s newest production announcement at the cutoff was the September 29 Windows 11 26H2 rollout, while the Windows 11 release table showed the September 29 26H2 entry and September 22 preview updates; Windows 10 and Windows Server tables still showed September production revisions.[1][10][11][12][13]

Windows Insider builds are previews, not production Exchange Server security packages. Do not use an Insider announcement as evidence that a normal Windows PC received this Exchange fix.[10]

Apple’s security table showed the latest macOS rows as September 28: macOS Golden Gate 27.0.1, macOS Tahoe 26.7.1, and macOS Sequoia 15.8.1. Apple’s developer release list and Tahoe notes also remained dated September 28, and the latest Background Security Improvement page was dated March 17; none of those pages showed an October 2 macOS release at our cutoff.[6][7][8][9]

For the current desktop context, see our Windows 11 26H2 general-availability guide and our September 28 macOS security-update guide. For the normal monthly cycle this release sits outside, see our September 2026 Patch Tuesday guide.

Good

  • Microsoft shipped fixes for all four affected on-premises branches listed in the CVRF.[1]
  • Exchange Online received a service-side fix without customer deployment.[1]
  • The vendor published exact KBs, fixed builds, exploitability status, and known issues.[1][2]

Cautions

  • “Exploited: No” is a cutoff-bound vendor status, while Microsoft still assesses exploitation as more likely.[1]
  • Exchange 2016 and 2019 require Period 2 ESU eligibility to receive these post-support updates.[3]
  • At least the Subscription Edition and Exchange 2019 CU15 packages carry known issues, so post-update functional testing matters.[2][3]
  • A “no restart required” field does not eliminate the need for an approved maintenance and recovery plan.[1]

FAQ

Is CVE-2026-96940 being exploited?

Microsoft’s October 2 CVRF says no exploitation was known at the reporting cutoff and the vulnerability was not publicly disclosed. Microsoft nevertheless rates exploitation as more likely, so administrators should not read the current “No” status as a reason to defer indefinitely.[1]

Does the attacker need an account?

Yes. Microsoft describes the attacker as authenticated, and the CVSS vector requires low privileges rather than no privileges. No user interaction is required once the prerequisite access exists.[1]

Does this let an attacker read every Microsoft 365 tenant?

No. Microsoft says successful exploitation can expose other users’ mailboxes within the same organization and explicitly says the vulnerability does not allow access across tenant boundaries.[1]

Do Exchange Online customers need to install anything?

No server package is required for Exchange Online customers to receive this fix. Microsoft says it already deployed the related service-side change.[1]

Should an Outlook user install KB5129955 through KB5129958?

No. Those KBs are for specific on-premises Exchange Server branches. Outlook and ordinary desktop users should continue normal client updating and leave Exchange Server maintenance to the responsible administrator.[1]

Is this October Patch Tuesday?

No. Microsoft titled the release “October 2026 Early Security Updates” and published it on Friday, October 2. It is an early, targeted Exchange Server release outside the normal monthly Windows security-update cycle.[1]

Official sources checked

  1. Microsoft Security Response Center — October 2026 Early Security Updates CVRF
  2. Microsoft Support — Exchange Server Subscription Edition RTM V2 (KB5129955)
  3. Microsoft Support — Exchange Server 2019 CU15 V2 (KB5129956)
  4. Microsoft Support — Exchange Server 2019 CU14 V2 (KB5129957)
  5. Microsoft Support — Exchange Server 2016 CU23 V2 (KB5129958)
  6. Apple security releases
  7. Apple Background Security Improvements by date
  8. Apple Developer releases
  9. Apple Support — What’s new in the updates for macOS Tahoe 26
  10. Microsoft Windows Message Center
  11. Microsoft Windows 11 release information
  12. Microsoft Windows 10 release information
  13. Microsoft Windows Server release information

Browse Articles

Latest Articles