Microsoft reissues September 2026 Exchange Server updates to add CVE-2026-96940

Microsoft ships a V2 of the September Exchange updates

Microsoft has re-released its September 2026 Exchange Server security updates as a second, V2 release, and the only change from the original packages is the inclusion of CVE-2026-96940. According to a post on dev.to, which draws on a SecurityOnline.info summary of the Exchange Team's announcement, Microsoft discovered the flaw through its own internal review and says it has seen no evidence of active exploitation.

The reissue matters to anyone who considers September's patching finished. Because the V2 packages contain a fix that was absent from the first release, servers patched in early September still need a second pass.

Which builds are covered

The V2 updates apply to four build lines across three product names:

• Exchange Server Subscription Edition (SE) RTM
• Exchange Server 2019 CU14
• Exchange Server 2019 CU15
• Exchange Server 2016 CU23

The dev.to post flags a practical trap in this range: an inventory query that matches only one product line will under-count what is in scope. Any asset search should explicitly match all four build combinations, since the covered set spans Subscription Edition, two cumulative updates of Exchange 2019, and the final supported build of Exchange 2016.

ESU enrolment decides who can download the fix

Exchange 2016 and Exchange 2019 have both left mainstream support. Fixes for those versions are therefore only available to organisations enrolled in the Period 2 Extended Security Update (ESU) programme, which covers updates released between May and October 2026. Subscription Edition RTM does not depend on ESU enrolment.

The dev.to post argues that this support boundary should sit in the same inventory as the build data. Servers on 2016 or 2019 that are not enrolled in ESU cannot receive the V2 packages at all, so those hosts should be routed toward migration rather than patching, and the inventory should make that distinction explicit.

How large is the exposed footprint

For a sense of scale, the dev.to post points to ZoomEye International, where the product fingerprint app="Microsoft Exchange Server" matched 1,098,562 assets as of 3 October 2026. That figure counts reachable Exchange deployments, not hosts confirmed vulnerable to CVE-2026-96940. Internet-wide counts show how common the product is; they cannot tell an organisation which of its own servers need attention.

The bridge between exposure data and an actionable patch list, the post explains, is an internal build report cross-checked against each server's ESU enrolment state, so every host maps to a package that can actually be downloaded.

What administrators should do

The recommended action is to install the update promptly. The steps set out in the dev.to post are straightforward: open the Microsoft Security Update Guide, identify the build matching each server, apply the cumulative package, reboot, and verify that every Exchange service came back up afterwards.

Teams that already deployed the original September release should treat the V2 package as a fresh deployment rather than a no-op, since the first-round updates predate the CVE-2026-96940 fix.

Why it matters

This story highlights two recurring problems in Exchange administration. First, a patch cycle is only complete when the final version of a package lands: organisations that closed out September's updates early are now quietly missing a fix, through no process failure of their own. Second, the ESU boundary splits the patchable population. With more than a million Exchange assets visible on the internet and fixes for the older versions gated behind an extended-support programme, a meaningful share of deployments may have no patch path at all, leaving migration as their only realistic remediation. For administrators, the immediate task is narrower: rebuild the inventory across all four builds, confirm ESU coverage for the legacy lines, and get the V2 packages installed.