# Microsoft patches multiple Exchange Server flaws

Published: 2026-10-13 · Severity: routine · Sectors: technology, government-national
Canonical: https://vorant.io/reports/f3fda9e4-fec3-588a-9720-6958ce7c6662/microsoft-patches-multiple-exchange-server-flaws

> Microsoft's cumulative Exchange Server update fixes seven vulnerability classes including RCE, spoofing, and privilege escalation; one flaw had a prior emergency patch.

NCSC-NL issued an advisory summarizing a Microsoft cumulative security update for Exchange Server that addresses multiple vulnerability classes: cross-site scripting, stack-based buffer overflow, improper cryptographic signature verification, insecure deserialization, inclusion of untrusted functionality, incorrect authorization, and weak authentication. Collectively these flaws could allow an attacker to impersonate another user, escalate privileges, or execute arbitrary code with the privileges of the Exchange process.

One vulnerability, tracked as CVE-2026-96940, was previously addressed via an out-of-band (emergency) update and has now been rolled into this cumulative release — a strong signal that it was considered urgent enough to warrant immediate patching ahead of the normal cycle. The advisory does not specify whether any of the other flaws are being actively exploited in the wild, but the breadth of impact (deserialization, buffer overflow, authentication bypass) on a widely deployed on-premises mail platform makes timely patching important.

Defenders running on-premises Exchange Server should apply the cumulative update referenced via the Microsoft Security Response Center portal as soon as possible, verify patch levels across all Exchange instances, and monitor for anomalous authentication, privilege escalation, or code execution activity on Exchange servers. No indicators of compromise or exploit details were published in this advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2026-96940

## Detection guidance (public sample)

### Exchange IIS Worker Process Spawning Command Shell or LOLBin

ATT&CK: T1190

w3wp.exe running an Exchange app pool spawns a shell or script/download utility, a typical sign of post-exploitation code execution after an Exchange vulnerability is exploited. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exchange IIS Worker Process Spawning Command Shell or LOLBin
description: Detects an IIS worker process hosting an Exchange application pool (OWA,
  ECP, EWS, Autodiscover) spawning a command interpreter or common download/execution
  utility. This indicates code execution in the context of the Exchange process after
  exploitation of deserialization, authorization or overflow flaws, or web shell use.
tags:
- attack.initial-access
- attack.t1190
- attack.execution
- attack.persistence
- attack.t1505.003
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith: \w3wp.exe
    ParentCommandLine|contains: MSExchange
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
    - \rundll32.exe
    - \regsvr32.exe
    - \whoami.exe
    - \net.exe
    - \net1.exe
  condition: selection
falsepositives:
- Exchange health or diagnostic scripts launched by the app pool on some custom configurations
- Third-party Exchange add-ins that shell out to cmd.exe from the OWA or ECP app pool
level: high
id: b932bef6-4d98-5706-8c29-856cb007b0a0
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0419.html
```

### Exchange Service Process Spawning Shell or Scripting Interpreter

ATT&CK: T1203

Core Exchange service processes (transport, unified messaging, mailbox assistants) spawn a shell or interpreter, which can indicate exploitation resulting in code execution with Exchange process privileges. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.

```yaml
title: Exchange Service Process Spawning Shell or Scripting Interpreter
description: Detects core Exchange service processes such as the transport service,
  Unified Messaging worker or mailbox assistants spawning a command shell or scripting
  host. Exploitation of buffer overflow or insecure deserialization flaws can give
  code execution with the privileges of these processes.
tags:
- attack.execution
- attack.t1203
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    ParentImage|endswith:
    - \UMWorkerProcess.exe
    - \UMService.exe
    - \EdgeTransport.exe
    - \MSExchangeTransport.exe
    - \MSExchangeMailboxAssistants.exe
    - \MSExchangeDelivery.exe
    - \MSExchangeSubmission.exe
    Image|endswith:
    - \cmd.exe
    - \powershell.exe
    - \pwsh.exe
    - \wscript.exe
    - \cscript.exe
    - \mshta.exe
    - \certutil.exe
    - \bitsadmin.exe
  condition: selection
falsepositives:
- Custom Exchange transport agents or monitoring tooling that invoke scripts from
  service processes
level: high
id: b247df78-08c6-5ea4-bce2-74fa1d97b097
status: experimental
author: Vorant
references:
- https://advisories.ncsc.nl/2026/ncsc-2026-0419.html
```

Behavioural rules are generated from public reporting — validate in your environment before deploying.

Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0419.html

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/f3fda9e4-fec3-588a-9720-6958ce7c6662/microsoft-patches-multiple-exchange-server-flaws.
In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), live profiles of the actors and CVEs it names, and the vendor research on the same campaign. Slack alerts fire on the vendors, sectors and countries a reader follows. A new account starts with three days of all of it, no card: https://vorant.io/signup