Microsoft Releases Emergency Exchange Server Update to Fix CVE-2026-96940

Microsoft has released a revised security update package for on-premises Exchange Server, dated September 2026, which includes a fix for CVE-2026-96940.

This V2 release applies to Exchange Server Subscription Edition, Exchange Server 2019, and Exchange Server 2016. Customers using Exchange Online are already protected and do not need this update.

The revised update was published on October 2, 2026, as a replacement for the original September 2026 Exchange Server Security Update.

Microsoft noted that this new package addresses CVE-2026-96940, along with other vulnerabilities reported by external security partners and identified through the company’s internal security processes.

Affected Exchange Versions

The September 2026 V2 security updates are available for the following products:

• Exchange Server Subscription Edition: Exchange SE RTM
• Exchange Server 2019: CU14 and CU15, through Period 2 Extended Security Updates (ESU)
• Exchange Server 2016: CU23, through Period 2 ESU

Exchange Server 2016 and Exchange Server 2019 have reached end of support, meaning the September 2026 V2 updates are available only to organizations enrolled in Microsoft’s Period 2 Extended Security Update program. This program provides eligible customers with security updates released between May and October 2026.

Organizations that are not enrolled in the ESU program will not receive the latest fixes for Exchange 2016 and 2019. They should plan to migrate to Exchange Server Subscription Edition to continue receiving security updates.

Microsoft does not list Exchange Online as affected. Customers using the cloud-hosted service do not need to deploy server-side security updates, but they should update any on-premises Exchange servers and Exchange Management Tools workstations that are still part of their environment.

The main addition in the V2 update is CVE-2026-96940, which was not included in the original security update package. Microsoft has directed administrators to the Microsoft Security Update Guide and the associated download knowledge base article for details on the vulnerabilities, including impacted product versions and security recommendations.

This update highlights an operational concern for enterprises running hybrid Exchange environments. Patching only the legacy on-premises infrastructure could leave administrators, management systems, and internet-facing mail servers vulnerable, even if mailboxes have migrated to Exchange Online.

Microsoft recommends that administrators first run the Exchange Server Health Checker script. This script inventories Exchange installations and identifies missing cumulative updates, security updates, or required manual remediation actions.

Before deploying the new security update, organizations should ensure their server is running a supported cumulative update. Administrators can use Microsoft’s Exchange Update Wizard to determine the correct upgrade path for their current Exchange build.

After installation, Microsoft advises rebooting the affected server and verifying that all Exchange services start successfully. If any services are disabled after patching, it may indicate an interrupted installation, which requires remediation before returning the system to production.

For setup failures or post-installation errors, Microsoft recommends using the SetupAssist script and referring to the Exchange update repair guidance.

Microsoft anticipates that both issues will be addressed in future updates. The V2 package also resolves problems with wrapper messages appearing in shared mailbox inboxes in hybrid deployments and delegated mailbox free/busy failures in Graph API-only hybrid environments.

Stops Cyber threats before impact with 21 min faster MTTR. Integrate ANYRUN’s Sandbox in your SOC.