Microsoft Exchange Vulnerability Explained: Why Businesses Need to Install the Latest Security Update

Microsoft Exchange Vulnerability Explained

If your company runs its own Exchange Server, Microsoft has a patch you shouldn't leave sitting. It fixes a flaw tracked as CVE-2026-96940, which can let a logged-in user read other people's email. If your company uses Exchange Online instead, you're in a different spot, and the good news is you don't have to install anything.

This article explains what the flaw is, which versions are affected, how to check whether a server is patched, and why cloud customers have an easier path. There's also a catch for older versions, and it needs attention now.

The short version

Microsoft has published an advisory for CVE-2026-96940, a security flaw in Exchange Server. Before you act on any numbers you’ve seen reported, such as the severity rating, which versions are affected, or what an attacker could do to mailboxes, confirm them in Microsoft’s official advisory. That’s where you’ll find the confirmed CVSS score, what an attacker needs to exploit it, and how wide the impact goes. How worried you should be comes down to two things: what level of access an attacker could get, and how your own Exchange environment is set up.

If you run Exchange on-premises, install the update that matches your Exchange version. If you use Exchange Online, you can relax: Microsoft has already rolled out a related fix, so there’s nothing for you to do.

What the flaw is, in plain words

Exchange is supposed to check who you are and what you're allowed to see. "Weak authorization" means that second check, the "are you allowed to see this?" part, wasn't strict enough. Microsoft's own description says it lets an authenticated attacker raise their privileges over a network.

The key word is "authenticated." The attacker already needs a valid login. So this isn't a bug that lets a stranger walk straight in from the internet. But a valid login isn't hard to come by for a determined attacker. Phished passwords and reused credentials are common. A low-level mailbox account that can read other people's mail becomes a real problem fast. That's my own reading of the risk, not a statement from Microsoft.

What it could expose

Microsoft says a successful attacker could read other users' messages and attachments within the same organization. For a business, that can mean contracts, invoices, HR emails, password reset messages and anything else in someone's inbox.

How serious is it, and is it being exploited?

Here's where the facts split, so I'll keep them apart.

• Severity. The flaw carries a CVSS score of 8.8 and is described as high-severity.
• Likelihood. Microsoft assessed it as "Exploitation More Likely." Microsoft also notes that this type of flaw has been exploited in the past.
• Active attacks. As of the reports I found, none are confirmed. Microsoft found the flaw internally, and the Exchange team says it isn't aware of active exploitation. That could change, so treat it as "not yet known," not "safe."

Microsoft's discovery of the vulnerability does not, by itself, establish whether attackers knew about or exploited it before the update was released. Administrators should check Microsoft's current advisory for the latest exploitation assessment and apply the applicable security update promptly.

Which Exchange versions are affected

Only on-premises Exchange is affected. The update covers Exchange Server Subscription Edition (SE) RTM, Exchange 2019 Cumulative Updates 14 and 15, and Exchange 2016 Cumulative Update 23.

Each version needs its own package, and you can’t swap one for another. Here’s which one goes with which:

• Exchange SE RTM: KB5129955
• Exchange 2019 CU15: KB5129956
• Exchange 2019 CU14: KB5129957
• Exchange 2016 CU23: KB5129958

The fixed build numbers are:

• Exchange SE RTM: build 15.02.2562.053
• Exchange 2019 CU15: build 15.02.1748.053
• Exchange 2019 CU14: build 15.02.1544.048
• Exchange 2016 CU23: build 15.01.2507.075

Security updates are tied to a specific cumulative update level. You can't apply the Exchange 2019 CU15 security update to a CU14 server. If your server is on an older cumulative update than the ones listed, it's not a straightforward patch. You'd need to move to a supported CU first.

The catch for Exchange 2016 and 2019

This is where a lot of small and mid-sized businesses will get caught off guard. Exchange Server 2016 and Exchange Server 2019 left regular support on October 14, 2025. Whether you can still get security updates now depends on Microsoft’s Extended Security Updates (ESU) terms and whether you qualify. So before you plan a patch or a migration, check with Microsoft directly to confirm that you’re enrolled and that you’re actually entitled to the update.

So there are two groups:

• Exchange SE: The security update is publicly available.
• Exchange 2016 and 2019: Without ESU, the update isn't available. In that case, Microsoft's route is migrating to Exchange Server SE.

Time is short on the ESU side too. Period 2 is valid until the end of October 2026. One report quotes Microsoft saying there will be no further extensions after that. That's under three weeks away. If you're on 2016 or 2019 and haven't planned your move to SE, this vulnerability is a loud reminder to start.

Already patched in September? You may still need to act

This is easy to miss. Microsoft issued a second version of its September 2026 Exchange security updates to address this flaw. The V2 packages include the eight September fixes and add CVE-2026-96940. So even if you installed the September update, you still need another maintenance window.

The release itself was a bit messy. Microsoft put a related fix into Exchange Online before a KB article explained it. The Exchange team later said the update was published ahead of its intended schedule. One admin blog also noted the update showed up on Windows Update for a day with no release note. That blogger adds that Exchange updates are usually installed manually from the downloaded .EXE, because Windows Update has caused problems in the past. That's one admin's advice, not Microsoft policy, so follow Microsoft's deployment guidance for your setup.

How admins can check patch status

Don't assume a server is patched because someone says they installed "the September update." Check the build number. Here's a simple approach.

1. Find your version and cumulative update. You need to know whether each server is SE, 2019 CU14, 2019 CU15 or 2016 CU23. That tells you which fixed build to look for.

2. Run the Exchange Server Health Checker. Microsoft's own KB tells admins to use it. It verifies that the installation succeeded and shows whether any extra actions are needed. It can also flag missing security updates and unsupported configurations.

3. Or check the build number by hand. Microsoft's build-number guidance provides a PowerShell command for checking the Exchange installation's file version. Run the following in the Exchange Management Shell:

Get-Command Exsetup.exe | ForEach-Object {$_.FileVersionInfo}

Compare the returned version with Microsoft's official build-number table and the fixed build for your Exchange version.

4. Be careful with Get-ExchangeServer. In Microsoft's own example, that command shows AdminDisplayVersion as Build 1748.10, while the Exsetup command shows 15.02.1748.037 on the same server. The two numbers don't match, so don't use AdminDisplayVersion alone to decide a server is patched.

5. Don't forget the tools. The Exchange team recommends installing security updates on all Exchange servers, plus all servers and workstations running the Exchange Management Tools, so the tools and servers stay compatible. That second part is the one people skip. An admin laptop with management tools installed is easy to forget.

6. Restart and test. After installing, restart the server and make sure the Exchange services start normally. Microsoft recommends installing right away, especially on internet-facing Exchange servers.

Known issues to plan for

Patches can break things, so read the notes before you start. For SE, Microsoft lists a few. Published calendar (.ics) links can return an HTTP 500 error. Free/busy can fail for delegated mailboxes in some hybrid setups that use Graph API only. A ContentEngine deadlock can happen because of missing Korean WordBreaker rule files. Microsoft's pages also list the .ics problem for 2019 CU15.

None of these is a reason to skip the update. They're a reason to test it on a non-production server first if you can, and to know what to look for afterward.

Why Exchange Online customers have a different path

Exchange Online is Microsoft's cloud email service. Microsoft runs the servers, so Microsoft patches them. The company already deployed a service-side fix, and Exchange Online customers aren't required to take any action.

If you’re on Exchange Online, Microsoft looks after the servers behind the service and handles the security updates on its end. You don’t install Exchange Server update packages on Microsoft’s hosted infrastructure.

Hybrid setups are a different story. If you run a hybrid deployment, you still need to check and patch any affected on-premises Exchange servers, as well as any machines where the management tools are installed, following Microsoft’s guidance.

Hybrid setups still have homework

Many companies run both: a cloud tenant plus a leftover on-premises Exchange server for management or hybrid connections. If that's you, the cloud fix doesn't cover the on-prem box. One admin blog says Exchange Online is already protected, with no action needed there, except for updating existing Exchange servers or workstations that run the Exchange Management Tools. If you still have an Exchange server in your building or data center, treat it like any other on-prem server and patch it.

Why this matters for your business

Email is where companies keep their secrets, and it's the first thing attackers go after. Exchange has also been a repeat target this year. Microsoft fixed CVE-2026-42897, an actively exploited Exchange flaw, in June 2026. A separate flaw, CVE-2026-62911, also drew attention. Earlier Exchange vulnerabilities have also highlighted the risks of delayed patching. If you include a specific count of exposed servers, cite the original research, identify the vulnerability being measured and include the date of the scan. A server count from one scan should not be treated as a complete measure of all exposed Exchange systems.

For a business owner without a big IT team, the takeaways are simple:

• Ask your IT provider whether you run Exchange on-premises or Exchange Online.
• If it's on-premises, ask which version and which build number, and whether it's at or above the fixed build.
• If it's 2016 or 2019, ask whether you're in the ESU program, and what the migration plan is.

What if you can't patch?

If you're on Exchange 2016 or 2019 with no ESU, the sources I found give one path: move to Exchange SE. I didn't find a Microsoft-published workaround for this specific flaw, so I won't suggest one. Until you migrate, limit who can log in, keep strong sign-in protections on mailboxes, and ask your IT partner for a short-term plan. Those are general good habits, not a fix.

One more heads-up: Microsoft's next Patch Tuesday is October 13, 2026. Check for new Exchange updates then. Don't wait for it to patch this one, though.

Final takeaway

CVE-2026-96940 doesn't let strangers break in, but it can let a logged-in user read other people's email. That's serious enough, especially with stolen passwords so common. If you run Exchange SE, install KB5129955 and check the build. If you run 2019 or 2016, you'll need ESU to get the fix, and ESU ends this month. If you use Exchange Online alone, Microsoft has already handled it.

Sources

• Exchange Server build numbers and release dates — Microsoft Learn
• Microsoft Security Response Center — Security Update Guide
• Microsoft CSS-Exchange — Exchange Server Health Checker
• Microsoft Exchange Team Blog

Disclaimer: 

Quick disclaimer: security guidance moves fast. Before you act on anything here, check Microsoft’s Security Update Guide and the Exchange team blog for the latest details. If you can, test updates in a non-production environment first. And this article isn’t a replacement for advice from your own IT or security team.

---

Written by Mr. Tarsem Singh

Founder & Editor, Beinfora

This article was researched and written by Mr. Tarsem Singh to provide clear, useful technology information for readers