Exchange Server Flaw CVE-2026-96940: Patch Tied to Expiring ESU

Microsoft has shipped an out-of-band fix for a high-severity Exchange Server vulnerability that lets one authenticated user read another user's mail. The patch is available for on-premises deployments. For organizations still on Exchange Server 2016 or 2019, though, getting it depends on whether they paid into a short-lived extended support arrangement that ends this month.

What the flaw does

The bug, tracked as CVE-2026-96940, is an elevation-of-privilege issue caused by weak authorization controls in on-premises Exchange Server 1. An attacker who already has valid credentials on the network can reach other users' mailboxes in the same organization, including messages and attachments 2. No further interaction from the victim is needed 1. Microsoft rated it CVSS 8.8, which puts it in the high-severity band 12.

The affected builds are:

• Exchange Server Subscription Edition RTM
• Exchange Server 2019 Cumulative Updates 14 and 15
• Exchange Server 2016 Cumulative Update 23

23

Exchange Online customers are not affected 2.

The accounts differ slightly on timing. One security outlet dates the release to October 2, 2026 2. Petri's coverage, published October 6, tells administrators to install the "V2" versions of the September 2026 updates 1. Read together, this looks like a reissued September package rather than a separate standalone fix. Administrators should check that they are running the V2 builds and not assume an earlier September install covers them.

No exploitation yet, but Microsoft is worried

Microsoft says it has no evidence of attacks using the flaw. At the time of reporting, CISA had not added it to its Known Exploited Vulnerabilities catalog 3. Microsoft did, however, label the bug "exploitation more likely" 13. Petri treats that rating as the reason to make the update a priority for on-premises shops 1.

Microsoft also said it pushed the fix "ahead of its intended schedule" and did not explain why 3. TechRadar suggests the exploitability rating may be explanation enough 3. That is a reasonable inference. When a vendor speeds up an out-of-band release with no public exploitation, it usually believes the bug is easy to weaponize or that a working exploit is close.

The requirement that the attacker already be authenticated limits the risk only on paper. Exchange environments have a long history of credential theft, password spraying, and compromised low-privilege accounts. In those settings, "authenticated" is often a small barrier. A single phished mailbox becoming a route to executive or legal correspondence is exactly the escalation defenders want to cut off.

The support catch for 2016 and 2019

The more important detail sits in how Microsoft now services older Exchange versions. TechRadar reports that a dedicated program gives eligible Exchange Server 2016 and 2019 customers security updates released between May and the end of October 2026 3. Organizations not enrolled are being told to move to Exchange Server Subscription Edition if they want to keep receiving security fixes 3.

That makes CVE-2026-96940 an awkward test case. The 2016 and 2019 builds are listed as vulnerable 23. Yet the reporting indicates their fixes now come through a paid, time-limited channel, not general availability. If that reading is correct, it creates three groups:

• Enrolled customers on the extended program can patch, but their coverage window closes at the end of October 3.
• Unenrolled customers have a known, high-severity mailbox-access flaw and, based on the available reporting, no straightforward path to an official fix other than migrating 3.
• Subscription Edition customers get the update through the normal channel.

Petri's advice that "organizations running on-premises Exchange Server" install the V2 September updates 1 reads as universal. It does not settle how 2016 and 2019 customers outside the program are supposed to get them. Administrators in that position should check their entitlement directly rather than assume coverage.

What to make of it

The technical response is simple: patch now, and confirm you are on the V2 builds. The strategic picture is less comfortable. A bug flagged as likely to be exploited, released early, and affecting versions whose security support is running out is the kind of event that pushes organizations off legacy on-premises Exchange. Microsoft's guidance points the same way, toward Subscription Edition or, implicitly, Exchange Online, which is not affected 23.

For teams that delayed migration, the October cutoff is close. If a comparable flaw appears in November, enrolled 2016 and 2019 customers may face the same exposure that unenrolled ones face today, with no extended program to fall back on. CVE-2026-96940 matters as a vulnerability. It also shows that running older Exchange versions now carries a deadline, not just an operational cost.