{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-000074f9f769","releaseDate":"2026-10-02T07:00:00-07:00","cveNumber":"CVE-2026-96940","cveTitle":"Microsoft Exchange Server Elevation of Privilege Vulnerability","releaseNumber":"2026-Oct","vulnType":"Security Vulnerability","latestRevisionDate":"2026-10-02T07:00:00-07:00","description":"<p>Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.</p>\n","cweList":["CWE-1390: Weak Authentication"],"cweDetailsListForSearch":["cwe: CWE-1390: Weak Authentication","cweUrl: https://cwe.mitre.org/data/definitions/1390.html"],"unformattedDescription":"<p>Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.</p>","mitreText":"CVE-2026-96940","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2026-96940","publiclyDisclosed":"No","exploited":"No","latestSoftwareReleaseId":1,"latestSoftwareRelease":"Exploitation More Likely","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Microsoft Exchange Server","issuingCna":"Microsoft","issuingCnaId":100000001,"severityId":100000001,"severity":"Important","impactId":100000002,"impact":"Elevation of Privilege","langCode":"en-US","baseScore":"8.8","temporalScore":"7.7","vectorString":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":1,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-1390: Weak Authentication","https://cwe.mitre.org/data/definitions/1390.html"]}],"articles":[{"title":"Microsoft Exchange Server Elevation of Privilege Vulnerability","articleType":"100000000","description":"<p>Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>Is Exchange Online affected, and do Exchange Online customers need to take action?</strong></p>\n<p>Microsoft has already deployed a related service-side fix to Exchange Online. Exchange Online customers do not need to take any action to receive the fix. Customers using affected on-premises Microsoft Exchange Server products should install the applicable security updates listed in the Security Updates table.</p>\n<p><strong>Where can I find more information?</strong></p>\n<p>Please see the <a href=\"https://techcommunity.microsoft.com/blog/exchange/released-september-2026-v2-exchange-server-security-updates/4561718\">Exchange blog</a> for more information.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>What privileges could be gained by an attacker who successfully exploited this vulnerability?</strong></p>\n<p>An authenticated attacker who successfully exploited this vulnerability could gain unauthorized access to other users' mailboxes within the same organization and read email messages and attachments. The vulnerability does not allow access across tenant boundaries.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2026-96940","version":1,"revisionDate":"2026-10-02T07:00:00-07:00","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":true,"notificationSent":true,"sourceId":"32d0fb3e-a0b7-f111-93a1-000d3ac5fb71"}]}