Microsoft patches multiple Exchange Server flaws
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Microsoft's cumulative Exchange Server update fixes seven vulnerability classes including RCE, spoofing, and privilege escalation; one flaw had a prior emergency patch.
NCSC-NL issued an advisory summarizing a Microsoft cumulative security update for Exchange Server that addresses multiple vulnerability classes: cross-site scripting, stack-based buffer overflow, improper cryptographic signature verification, insecure deserialization, inclusion of untrusted functionality, incorrect authorization, and weak authentication. Collectively these flaws could allow an attacker to impersonate another user, escalate privileges, or execute arbitrary code with the privileges of the Exchange process.
One vulnerability, tracked as CVE-2026-96940, was previously addressed via an out-of-band (emergency) update and has now been rolled into this cumulative release — a strong signal that it was considered urgent enough to warrant immediate patching ahead of the normal cycle. The advisory does not specify whether any of the other flaws are being actively exploited in the wild, but the breadth of impact (deserialization, buffer overflow, authentication bypass) on a widely deployed on-premises mail platform makes timely patching important.
Defenders running on-premises Exchange Server should apply the cumulative update referenced via the Microsoft Security Response Center portal as soon as possible, verify patch levels across all Exchange instances, and monitor for anomalous authentication, privilege escalation, or code execution activity on Exchange servers. No indicators of compromise or exploit details were published in this advisory.
Mentioned in this report
Detection guidance
Exchange IIS Worker Process Spawning Command Shell or LOLBin
w3wp.exe running an Exchange app pool spawns a shell or script/download utility, a typical sign of post-exploitation code execution after an Exchange vulnerability is exploited. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Exchange IIS Worker Process Spawning Command Shell or LOLBin
description: Detects an IIS worker process hosting an Exchange application pool (OWA,
ECP, EWS, Autodiscover) spawning a command interpreter or common download/execution
utility. This indicates code execution in the context of the Exchange process after
exploitation of deserialization, authorization or overflow flaws, or web shell use.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.persistence
- attack.t1505.003
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith: \w3wp.exe
ParentCommandLine|contains: MSExchange
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
- \rundll32.exe
- \regsvr32.exe
- \whoami.exe
- \net.exe
- \net1.exe
condition: selection
falsepositives:
- Exchange health or diagnostic scripts launched by the app pool on some custom configurations
- Third-party Exchange add-ins that shell out to cmd.exe from the OWA or ECP app pool
level: high
id: b932bef6-4d98-5706-8c29-856cb007b0a0
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0419.html
Exchange Service Process Spawning Shell or Scripting Interpreter
Core Exchange service processes (transport, unified messaging, mailbox assistants) spawn a shell or interpreter, which can indicate exploitation resulting in code execution with Exchange process privileges. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: Exchange Service Process Spawning Shell or Scripting Interpreter
description: Detects core Exchange service processes such as the transport service,
Unified Messaging worker or mailbox assistants spawning a command shell or scripting
host. Exploitation of buffer overflow or insecure deserialization flaws can give
code execution with the privileges of these processes.
tags:
- attack.execution
- attack.t1203
logsource:
category: process_creation
product: windows
detection:
selection:
ParentImage|endswith:
- \UMWorkerProcess.exe
- \UMService.exe
- \EdgeTransport.exe
- \MSExchangeTransport.exe
- \MSExchangeMailboxAssistants.exe
- \MSExchangeDelivery.exe
- \MSExchangeSubmission.exe
Image|endswith:
- \cmd.exe
- \powershell.exe
- \pwsh.exe
- \wscript.exe
- \cscript.exe
- \mshta.exe
- \certutil.exe
- \bitsadmin.exe
condition: selection
falsepositives:
- Custom Exchange transport agents or monitoring tooling that invoke scripts from
service processes
level: high
id: b247df78-08c6-5ea4-bce2-74fa1d97b097
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0419.html
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0419.html
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs