CVE-2026-96940
published 2026-10-02CVE-2026-96940: Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
PriorityP260high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
0.48%
40.9th percentile
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
Affected
8 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server | — | — |
| microsoft | exchange_server_subscription_edition | < 15.02.2562.053 | 15.02.2562.053 |
| microsoft | microsoft_exchange_server_2016_cumulative_update_23 | >= 15.01.0.0 < 15.01.2507.075 | 15.01.2507.075 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_14 | >= 15.02.0.0 < 15.02.1544.048 | 15.02.1544.048 |
| microsoft | microsoft_exchange_server_2019_cumulative_update_15 | >= 15.02.0.0 < 15.02.1748.053 | 15.02.1748.053 |
| microsoft | microsoft_exchange_server_subscription_edition_rtm | >= 15.02.0.0 < 15.02.2562.053 | 15.02.2562.053 |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
ghsa_unreviewed·2026-10-02
CVE-2026-96940 [HIGH] CWE-1390 Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network.
VulDB
Microsoft Exchange Server improper authorization
vuldb·2026-10-02·CVSS 8.8
CVE-2026-96940 [HIGH] Microsoft Exchange Server improper authorization
A vulnerability categorized as very critical has been discovered in Microsoft Exchange Server. Affected by this vulnerability is an unknown functionality. Such manipulation leads to improper authorization.
This vulnerability is traded as CVE-2026-96940. The attack may be launched remotely. There is no exploit available.
It is advisable to implement a patch to correct this issue.
No detection rules found.
No public exploits indexed.
Sans Isc
October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
blogs_sans_isc·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] October 2026 Microsoft Patch Tuesday, (Tue, Oct 13th)
October 2026 Microsoft Patch Tuesday
Published: 2026-10-13. Last Updated: 2026-10-13 19:25:52 UTC
by Johannes Ullrich (Version: 1)
0 comment(s)
Microsoft today released patches for 1,417 vulnerabilities. 76 of these vulnerabilities are rated critical, with 7 critical vulnerabiilties requiring no customer actions. One vulnerability was disclosed before today's patch Tuesday, and one is already exploited.
CVE-2026-96951: An already exploited Windows Shell Security Feature Bypass Vulnerability. This vulnerabliity allows bypassing the "Mark of the Web" making it easier to exeucte code by sending a malicious message to a user via e-mail or instant messaging. The victim will still have to open the file.
CVE-2026-108398: This vulnerability, a .NET framework security feature bypass, could be
Qualys
Microsoft Patch Tuesday, October 2026 Security Update Review
blogs_qualys·2026-10-13
CVE-2026-96951 Microsoft Patch Tuesday, October 2026 Security Update Review
## Table of Contents
Adobe Patch for October 2026
Zero-day Vulnerabilities Patched in September Patch Tuesday Edition
Critical Severity Vulnerabilities Patched in September Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities inVulnerability Management, Detection & Response (VMDR)
Rapid Response withTruRisk Eliminate
Qualys Monthly Webinar Series
Microsoft has released its October 2026 Patch Tuesday security updates, addressing vulnerabilities across its products and services. As organizations continue to navigate an evolving threat landscape, applying security patches promptly remains critical to reducing exposure and strengthening security posture. This month’s updates highlight the importance of identif
Tenable
Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
blogs_tenable·2026-10-13·CVSS 8.8
CVE-2026-96951 [HIGH] Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
## Microsoft’s October 2026 Patch Tuesday addresses 1407 CVEs (CVE-2026-96951)
69 Critical
1337 Important
0 Moderate
1 Low
Microsoft addresses 1407 CVEs in the tenth Patch Tuesday of 2026, marking the second consecutive month to reset the bar as the largest Patch Tuesday release. This month’s updates include patches for two zero days, including one that was exploited in the wild.
Microsoft patched 1,407 CVEs in its October 2026 Patch Tuesday release, with 69 rated critical, 1,337 rated as important, and one rated as low.
This month’s update includes patches for 301 products and components. The following table lists the products with the most CVEs patched this month. A full list of patched products is available in the appendix.
1
Microsoft Office Excel
69
2
Role: DNS Server
52
Talos
Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
blogs_talos·2026-10-13·CVSS 9.8
CVE-2026-96951 [CRITICAL] Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
## Microsoft Patch Tuesday for October 2026 — Snort rules and prominent vulnerabilities
Microsoft has released its monthly security update for October 2026, which includes 1415 vulnerabilities affecting a range of products, including 85 that Microsoft marked as "critical."
Microsoft notes that 1 of the vulnerabilities disclosed this month have been exploited in the wild
CVE-2026-96951 is a security feature bypass vulnerability that affects Windows Shell. The shared weakness is Improper Neutralization of Special Elements used in a Command ('Command Injection'). The vulnerability has a CVSS base score of 8.8.
Out of 85 "critical" vulnerabilities, 67 are remote code execution (RCE) vulnerabilities.
Microsoft considers exploitation of the following vulnerabilities more likely.
CVE-2026-7
Hackernews
⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
blogs_hackernews·2026-10-12·CVSS 9.3
CVE-2026-21589 [CRITICAL] ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, ShinyHunters Arrest, AI-Fooling Malware and More
Some meetings last longer than it took attackers to jump on a newly disclosed security flaw this week. Within hours, they were already testing it. That's not much time to read the warning, let alone do something about it.
But speed is only part of the problem. A secure connection didn't always mean a safe destination. People offering to fix a ransomware mess had questions to answer themselves. Malware got better at hiding its tracks. And some systems turned out to be easier to break into than anyone would like to admit. The odd par
Hackernews
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
blogs_hackernews·2026-10-05·CVSS 8.8
CVE-2026-96940 [HIGH] Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
Home
Threat Intelligence
Vulnerabilities
Cyber Attacks
Webinars
Expert Insights
Awards
Webinars
Awards
Free eBooks
About THN
Jobs
Advertise with us
## Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions.
The vulnerability, tracked as CVE-2026-96940 , is rated 8.8 on the CVSS scoring system.
"Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network," Microsoft said in an advisory released on October 2, 2026.
The Windows maker said an authenticated attacker can exploit this flaw to gain unauthorize
2026-10-02
Published