Microsoft Exchange Online: stack-based buffer overflow allows authorized attackers to execute remote code (CVE-2026-96185)
Severity: high · Patch status: patched · Since 2026-10-22 · CVE-2026-96185
Microsoft disclosed CVE-2026-96185, a stack-based buffer overflow in Microsoft Exchange Online that permits an authorized attacker to execute arbitrary code over a network. Because Exchange Online is a cloud service, Microsoft has remediated the flaw on its side; no customer-side patch is required. The vulnerability requires the attacker to already hold authorized access, which limits exposure compared with unauthenticated RCE, but successful exploitation could yield code execution within the service context. No exploitation in the wild or public proof-of-concept has been reported. Organizations using Exchange Online should review their tenant for signs of compromise and ensure they are on current service builds.
What to do
- Review Microsoft 365 audit and sign-in logs for anomalous activity by authorized accounts, especially privileged or service accounts
- Verify your tenant is on the current Exchange Online service build and confirm Microsoft's advisory status
- Tighten authorization controls: enforce MFA, least privilege, and conditional access for accounts with Exchange Online access
- Monitor Microsoft MSRC and Message Center for updates on exploitation status or further guidance
Sources
All live incidents on Threat Watch
