Locating Exchange servers that match the CVE-2026-96940 advisory scope
Locating Exchange servers that match the CVE-2026-96940 advisory scope The advisory scope Microsoft shipped a V2 release of its September 2026 Exchange Server security updates. The only change against the original release is the addition of CVE-2026-96940. The Exchange Team states it identified the vulnerability internally and is not aware of active exploitation. The V2 updates cover Exchange…
Microsoft has released a V2 update for its September 2026 Exchange Server security patches, adding the fix for CVE-2026-96940. This advisory impacts Exchange Server Subscription Edition RTM, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23. These four combinations, spanning three product names, were identified by ZoomEye International, which reported 1,098,562 assets matching the product fingerprint app=Microsoft Exchange Server on October 3, 2026.
However, merely having this product fingerprint does not indicate a server's vulnerability to CVE-2026-96940. To identify the actual vulnerable servers, an internal build report must be cross-referenced with the Extended Security Update (ESU) enrolment status. This ensures each server corresponds with a downloadable package. Servers outside the ESU program cannot receive the V2 packages for older lines and should be part of a migration plan rather than a patch track.
Organizations should apply the cumulative update, reboot the servers, and verify that all Exchange services are operational.
Written by urgent.news from Dev.to's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
