CVE-2026-96940

Fix

Microsoft's update · Important

• KB5129957 — Microsoft Exchange Server 2019 Cumulative Update 14 · build 15.02.1544.048
• KB5129958 — Microsoft Exchange Server 2016 Cumulative Update 23 · build 15.01.2507.075
• KB5129955 — Microsoft Exchange Server Subscription Edition RTM · build 15.02.2562.053
• KB5129956 — Microsoft Exchange Server 2019 Cumulative Update 15 · build 15.02.1748.053

From the 2026-Oct release note of Microsoft's Security Update Guide, revised 2026-10-28 · Exploitation More Likely.

Public exploits 1

• HORKimhab/CVE-2026-96940 PoC on GitHub

Each line links to the index that lists it, never to exploit code. Exploit-DB's "verified" and a Metasploit rank of good or better count as verified; a PoC-in-GitHub entry is a repository's claim.

Patch, vendor advisory and mitigation references on NVD 1

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940 Patch, Vendor Advisory

Every line above is quoted from NVD, CISA, Microsoft, the vendor's own advisory or DISA; nothing is generated.