Vulnerability

CERT-In Vulnerability Note CIVN-2026-0501
Elevation of Privilege Vulnerability in Microsoft Exchange Server

Original Issue Date:October 14, 2026

Severity Rating: CRITICAL

Systems Affected

Microsoft Exchange Server Subscription Edition RTM
Microsoft Exchange Server 2019 Cumulative Update 14 and prior
Microsoft Exchange Server 2019 Cumulative Update 15 and prior
Microsoft Exchange Server 2016 Cumulative Update 23 and prior

Overview

A vulnerability has been reported in Microsoft Exchange Server which could allow a remote attacker to elevate privileges on the targeted system.

Target Audience:
All end-user organizations and individuals using the Microsoft Exchange Server.

Risk Assessment:
High risk of elevating privileges, bypass security restrictions, and gaining unauthorized access.

Impact Assessment:
Potential for unauthorized access to sensitive information and disclosure of confidential emails and mailbox data.

Description

Microsoft Exchange Server is an enterprise email and collaboration platform used by organizations to manage email, calendars, contacts, tasks, and shared mailboxes.

An elevation of privilege vulnerability exists in Microsoft Exchange Server due to weak authorization. A remote attacker could exploit these vulnerabilities by sending a specially crafted request to the targeted system.

Successful exploitation of this vulnerability could allow an attacker to elevate privileges and gain unauthorized access to other users mailboxes within the same organization, including reading email messages and attachments, on the targeted system.

Solution

Apply appropriate updates as mentioned by the vendor:
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940

Vendor Information

Microsoft
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940

References

Microsoft
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940

CVE Name
CVE-2026-96940

Disclaimer

The information provided herein is on "as is" basis, without warranty of any kind.

Contact Information

Email: info@cert-in.org.in
Phone: +91-11-22902657

Postal address

Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India