A critical vulnerability, CVE-2026-96940 with a CVSS score of 9.8, was discovered internally by Microsoft in its Exchange Server products, including Exchange Server Subscription Edition (SE) RTM, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23. The flaw type and attack vector are not explicitly stated in the article, but it is described as a critical vulnerability with significant business impact. Affected versions include Exchange SE, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23, although older versions that are out of support should consider moving to Exchange SE. Hybrid customers must install the update on their Exchange servers and workstations running the Exchange Management Tools, as Exchange Online is already protected.
We recommend you to update Exchange Server to version SE RTM.[/subscribe_to_unlock_form]
A critical vulnerability, CVE-2026-96940 with a CVSS score of 9.8, was discovered internally by Microsoft in its Exchange Server products, including Exchange Server Subscription Edition (SE) RTM, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23. The flaw type and attack vector are not explicitly stated in the article, but it is described as a critical vulnerability with significant business impact. Affected versions include Exchange SE, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23, although older versions that are out of support should consider moving to Exchange SE. Hybrid customers must install the update on their Exchange servers and workstations running the Exchange Management Tools, as Exchange Online is already protected.
We recommend you to update Exchange Server to version SE RTM.[emaillocker id="1283"]
The following reports contain further technical details:
[/emaillocker]