# Microsoft Reissues September 2026 Exchange Server Updates (V2) for CVE-2026-96940 Mailbox Authorization Flaw

> Microsoft released V2 of its September 2026 Exchange Server security updates after the original release (SU10, 8 September) did not include a fix for CVE-2026-96940, a weak authorization flaw (CVSS 8.8) that lets an authenticated attacker access other users' mailboxes within the same organization. Microsoft found the flaw internally and reported no active exploitation.

- **Published:** 2026-10-03T00:00:00Z
- **Last reviewed:** 2026-10-10T16:13:21.364Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-2864
- **ID:** TL-2026-2864
- **Severity:** HIGH (CVSS 8.8)
- **Category:** VULNERABILITY
- **Status:** PATCHED
- **Detections:** 9 · **IOCs:** 21 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-96940

## Description

CVE-2026-96940 is a weak-authorization vulnerability (CWE-1390) in on-premises Microsoft Exchange Server. The CVE record describes it as allowing an authenticated attacker to elevate privileges over a network; Microsoft's Exchange Team and press coverage describe the practical impact as an authenticated attacker accessing other users' mailboxes in the same organization, exposing email messages and attachments. The scoring is CVSS 3.1 AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (8.8, High). No user interaction is required, and access does not cross tenant boundaries. Exchange Online customers are already protected.

Affected products are Exchange Server Subscription Edition (SE) RTM, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23. Per CVE tracker data, vulnerable build ranges are 15.1.x below 15.1.2507.75 (2016 CU23), 15.2.x below 15.2.1544.48 (2019 CU14), 15.2.x below 15.2.1748.53 (2019 CU15) and 15.2.x below 15.2.2562.53 (SE RTM).

The original September 2026 Exchange security updates were released on 8 September 2026 (SE SU10 KB5121608; 2019 CU15 KB5121609; 2019 CU14 KB5121610; 2016 CU23 KB5121611) and addressed nine other CVEs, but not CVE-2026-96940. The CVE was reserved on 23 September 2026. The SE SU10v2 package (KB5129955) began appearing through Windows Update/WSUS on 1 October 2026 before any documentation existed, and Microsoft announced the 'September 2026 V2 Exchange Server Security Updates' on the Exchange Team Blog on 2 October 2026. The only difference between the original release and V2 is the addition of CVE-2026-96940. Microsoft said it published the V2 updates ahead of its intended schedule so attackers would not discover and exploit the flaw first.

Microsoft found the vulnerability internally and was not aware of active exploitation. The CVE is not in the CISA KEV catalog (version 2026.10.02), and no public proof-of-concept was detected by CVE trackers. Administrators who installed the earlier September release should install the V2 packages rather than assume they are protected. Updates are applied to every Exchange server and Exchange Management Tools workstation, including management-only systems in hybrid deployments. Exchange 2016 and 2019 updates are available only to organizations enrolled in the Extended Security Update (ESU) Period 2 program (May-October 2026), with no further extensions planned. Cyber Security News notes a separate earlier Exchange flaw, CVE-2026-62911 (authentication relay), as related context.

## MITRE ATT&CK

- T1078 Valid Accounts
- T1087.003 Account Discovery: Email Account
- T1114 Email Collection
- T1114.002 Email Collection: Remote Email Collection
- T1068 Exploitation for Privilege Escalation

## Sources

- [Microsoft Pushes New Exchange V2 Update After Discovering New Security Flaw](https://cybersecuritynews.com/microsoft-reissues-exchange-server-update/)
- [Released: September 2026 V2 Exchange Server Security Updates](https://techcommunity.microsoft.com/blog/exchange/released-september-2026-v2-exchange-server-security-updates/4561718)
- [MSRC Security Update Guide: CVE-2026-96940](https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940)
- [Security Updates Exchange 2016-SE (Sep2026)](https://eightwone.com/2026/09/08/security-updates-exchange-2016-se-sep2026/)
- [Exchange Server SE SU10 has been released](https://blog.icewolf.ch/archive/2026/09/09/exchange-server-SE-SU10-has-been-released/)
- [Exchange SE Update KB5129955 is circulating via Windows Update / WSUS](https://www.frankysweb.de/en/exchange-se-update-kb5129955-is-circulating-via-wsus/)
- [CVE-2026-96940: CWE-1390 Weak Authentication in Microsoft Exchange Server (OffSeq Threat Radar)](https://radar.offseq.com/threat/cve-2026-96940-cwe-1390-weak-authentication-in-microsoft-microsoft-exchange-server-2016-cumulative-5905209ea62ed103)
- [CVE-2026-96940: Vulnerability Details - Analysis & Fix (The Hacker Wire)](https://www.thehackerwire.com/vulnerability/CVE-2026-96940/)
- [Microsoft Pushes New Exchange V2 Update After Discovering New Security Flaw (Cryptika)](https://www.cryptika.com/microsoft-pushes-new-exchange-v2-update-after-discovering-new-security-flaw/)
- [On-premises Exchange administrators must install V2 security updates to fix elevation flaws (Neowin)](https://www.neowin.net/news/on-premises-exchange-administrators-must-install-v2-security-updates-to-fix-elevation-flaws/)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-2864