Release roundup
Microsoft Patch Tuesday, October 2026: one Exchange Server elevation-of-privilege fix
Microsoft's October 2026 Patch Tuesday contains one CVE: CVE-2026-96940, a high-severity (CVSS 8.8) elevation-of-privilege flaw in Microsoft Exchange Server. An authenticated attacker can exploit it over the network. No active exploitation is reported. Apply the Exchange update.
The release at a glance
Microsoft's October 2026 Patch Tuesday is a single-item release for our readers: one CVE in scope, with high severity under CVSS 3.1. The vulnerability, CVE-2026-96940, affects Microsoft Exchange Server and is described in the CVE record as weak authorization in the product. An authenticated attacker can elevate privileges over a network. Microsoft rates the issue Important. The weakness has a CVSS 3.1 score of 8.8 and a network vector with low attack complexity, low privileges, and no user interaction required. The release contains no exploited CVEs and no entries in CISA's KEV catalogue. No public disclosure or vendor statement of exploitation is associated with CVE-2026-96940. SSVC lists exploitation as none, automatable as no, and technical impact as total. For organisations running Exchange Server, this update is small but relevant.
What matters most
CVE-2026-96940 is the only issue to assess in this release. It affects four Microsoft Exchange Server builds: Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Update 14, Exchange Server 2019 Cumulative Update 15, and Exchange Server Subscription Edition RTM. Affected versions run from 15.01.0.0 or 15.02.0.0 up to just before the fixed builds. The flaw is an elevation of privilege: weak authorization allows an attacker who already has low privileges to elevate over the network without user interaction. The CVSS 3.1 vector CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C gives high confidentiality, integrity and availability impact. The score is 8.8, high severity; Microsoft's rating is Important. EPSS probability is 0.5 percent, percentile 40. There is no CISA KEV entry, no public disclosure and no reported exploitation. Because the privilege boundary is crossed from low to high, this matters for any Exchange deployment with authenticated users, not only those exposed anonymously to the Internet.
Patch in this order
Patch in this order: 1. Apply the Exchange Server security update to every affected Exchange deployment. This is the only CVE in the October Patch Tuesday release, so it is the entire priority list. The fixed builds are: Exchange Server 2016 Cumulative Update 23 — update to 15.01.2507.075, KB5129958; Exchange Server 2019 Cumulative Update 14 — update to 15.02.1544.048, KB5129957; Exchange Server 2019 Cumulative Update 15 — update to 15.02.1748.053, KB5129956; Exchange Server Subscription Edition RTM — update to 15.02.2562.053, KB5129955. 2. Because the vector is network and the outcome includes complete confidentiality, integrity and availability impact, treat all affected Exchange servers as patch targets, not only those directly exposed to the internet. Before deployment, confirm each server's cumulative update level against the fixed builds above. No other CVEs are in scope. This CVE is not in CISA KEV, so no CISA due date applies.
Beyond the patch
An October Patch Tuesday with a single Exchange elevation-of-privilege fix is straightforward to close out, but that simplicity depends on knowing exactly which Exchange builds and cumulative updates you run. Managed Detection & Response (MDR) provides the EDR and SIEM telemetry to spot privilege escalation or credential abuse that follows exploitation of a flaw like this. Supply Chain Defense & Third-Party Risk tracks the software and patch-cycle exposure across your estate, so the next Exchange update lands before it becomes a backlog.
Every CVE in this release
| CVE | Product | Severity | |
|---|---|---|---|
| CVE-2026-96940 | Microsoft Exchange Server 2016 Cumulative Update 23 | High 8.8 |