Security1 hOctober 15, 2026, 19:01

Microsoft ships V2 Exchange updates patching CVE-2026-96940

Microsoft reissued its September 2026 Exchange Server security updates, adding CVE-2026-96940. The flaw was found internally with no known exploitation. Fixes cover Exchange SE RTM, 2019 CU14/CU15 and 2016 CU23, with older lines limited to ESU-enrolled organizations.

DEV Community

Open source

Microsoft ships V2 Exchange updates patching CVE-2026-96940

V2 updates add only CVE-2026-96940 to the September release
Fixes cover Exchange SE RTM, 2019 CU14/CU15 and 2016 CU23
Exchange 2016 and 2019 require ESU Period 2 enrollment (May–October 2026)
ZoomEye counted 1,098,562 internet-facing Exchange assets on October 3, 2026

#Microsoft#Exchange

Exchange Server 2016 and 2019 need V2 security updates for elevation flaws

Security

CVE-2026-62911: Exchange auth bypass leads to SYSTEM-level RCE

Security

CVE-2026-62911: 22,000 Exchange Servers Still Unpatched

Security

Microsoft ships V2 Exchange updates patching CVE-2026-96940

Exchange Server 2016 and 2019 need V2 security updates for elevation flaws

CVE-2026-62911: Exchange auth bypass leads to SYSTEM-level RCE

CVE-2026-62911: 22,000 Exchange Servers Still Unpatched

Issabel Framework ships hardcoded JWT key in pbxapi (CVE-2026-89026)