With the October 2026 Early Security Updates, Microsoft published an Exchange Server vulnerability that small and midsized organisations with on-premises or hybrid Exchange should review without delay. CVE-2026-96940 affects Outlook Web Access (OWA), has a CVSS score of 8.8, is rated “Important”, and is classified by Microsoft as “Exploitation More Likely”. Exchange Online has already received a service-side fix; the customer action applies to affected on-premises Exchange Server products.
What Microsoft says about CVE-2026-96940
According to Microsoft, the vulnerability exists when Exchange OWA fails to properly handle web requests. An attacker with an existing sign-in could perform script or content injection attacks and try to trick users into disclosing sensitive information. Microsoft also states that an attacker could send a specially crafted email or use a chat client to persuade a user to click a malicious link; exploitation requires that user click.
For risk assessment, the nuance matters: Microsoft does not list the vulnerability as publicly disclosed or exploited. The “Exploitation More Likely” rating still means administrators should not treat this as a routine maintenance item.
Which Exchange systems are affected
The MSRC record lists four affected on-premises Exchange products. Organisations that only use Exchange Online do not need to take action for this CVE, according to Microsoft. But if an Exchange Server still exists for historical reasons, SMTP relay, management tooling or hybrid identity, its version and update state need a separate check.
- Microsoft Exchange Server Subscription Edition RTM: KB5129955, fixed build 15.02.2562.053.
- Microsoft Exchange Server 2019 Cumulative Update 15: KB5129956, fixed build 15.02.1748.053.
- Microsoft Exchange Server 2019 Cumulative Update 14: KB5129957, fixed build 15.02.1544.048.
- Microsoft Exchange Server 2016 Cumulative Update 23: KB5129958, fixed build 15.01.2507.075.
Deadline and priority for SMBs
Microsoft does not give a future retirement date for this issue; it released the updates on 2 October 2026. The practical deadline is therefore the next controlled maintenance window. For companies with 10 to 250 users, that matters because local Exchange servers are often rarely touched, while still providing internet-facing OWA, administrative access or hybrid mail functions.
The cloud CVEs in the same release need a different reading: for Microsoft Bookings, Partner Center, Dataverse and Azure App Service, Microsoft states that the vulnerabilities have already been fully mitigated by Microsoft and that there is no user action to take. This guide therefore focuses only on Exchange Server.
Why Exchange Online is different
In the FAQ for CVE-2026-96940, Microsoft says it has already deployed a related service-side fix to Exchange Online. Exchange Online customers do not need to take action to receive that fix. That does not automatically clear hybrid environments: once a local Exchange Server remains in the tenant architecture, its patch level is a separate operational responsibility.
In Microsoft 365 consulting, it is common to find that mailboxes have long since moved to the cloud while old servers remain for management, relay or third-party applications. These systems should not disappear into a vague “legacy” category; they need an owner, version, exposure assessment and hardening plan.
What administrators should check now
- Inventory every local Exchange Server, including disabled or supposedly internal management servers.
- Compare cumulative update level and build number with the fixed builds and KB numbers listed by Microsoft.
- Plan installation of the applicable security update, with backup, maintenance window and rollback path checked first.
- Confirm whether OWA or the Exchange Admin Center is reachable from the internet, and restrict access where it is not required.
- After updating, review sign-in logs, OWA access and suspicious link campaigns since the publication date.
If it is unclear whether a local Exchange Server is still required, do not turn that into a licensing recommendation. The relevant question is technical dependency: which systems still use it, which identity or mail flows rely on it, and whether the safer route is hardening, isolation or retirement.
Official Microsoft sources
- Microsoft Security Update Guide: CVE-2026-96940
- Microsoft Security Update Guide: October 2026 Early Security Updates
- Microsoft Exchange Team Blog: September 2026 V2 Exchange Server Security Updates
As part of a Microsoft Security Assessment, ReByteIT checks whether local Exchange servers, hybrid remnants and external access paths are documented and updated. If you need help with the technical assessment, you can book a call.
What does this mean for your environment?
Assess the topic in the context of your Microsoft 365 environment and define a practical next step.
You speak directly with Sebastian Kerssen – working in the Microsoft ecosystem since 2014, with personal consulting and a dedicated point of contact.
