Microsoft Reissues September 2026 Exchange Server Security Updates to Add CVE-2026-96940

Microsoft released a V2 September 2026 Exchange Server security update that adds CVE-2026-96940; administrators are urged to install the cumulative patch promptly. The update covers Exchange Server Subscription Edition RTM and specific 2019/2016 CUs (2019 CU14/CU15 and 2016 CU23), but 2016/2019 fixes require enrollment in the Period 2 ESU program. Microsoft says it discovered the flaw internally and is not aware of active exploitation; Exchange Online is already protected but hybrid servers and management workstations must be patched. The release includes two known issues (calendar .ics HTTP 500 error and a ContentEngine deadlock for Korean mailboxes) and resolves two hybrid-related problems; admins should run the Exchange Health Checker, reboot after install, and verify services.