CVE-2026-96940
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVSS
8.8
High
EPSS
0.5%
p41
KEV
—
Exploit Today
12
0-100
Published: Oct 2, 2026 · Last modified: Oct 15, 2026 · CWE-1390
0.5%EPSS · 30 days0.5%
2026-10-032026-10-21
Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.
CVECVSSEPSSKEVRExploitTitleMod.
CVE-2026-881017.8 HIG10.1%
——3Weak authentication in Microsoft Input Method Editor (IME) allows an authorized attacker to elevate privileges locally.6dCVE-2026-859395.3 MED30.5%
——9Weak authentication in Windows Kernel allows an authorized attacker to bypass a security feature over a network.6dCVE-2026-859227.4 HIG44.4%
——13Weak authentication in Azure Key Vault allows an unauthorized attacker to bypass a security feature over a network.6dCVE-2026-853767.8 HIG19.1%
——6Weak authentication in Windows Print Spooler Components allows an authorized attacker to elevate privileges locally.6dCVE-2026-853287.0 HIG11.8%
——4Weak authentication in Windows Projected File System allows an authorized attacker to elevate privileges locally.6dCVE-2026-853236.8 MED40.5%
——12Weak authentication in Network Device Enrollment Service (NDES) allows an authorized attacker to perform spoofing over a network.6d