Live › vulnerability › CVE-2026-96185
Go to dashboardA stack-based buffer overflow in Microsoft Exchange Online lets an attacker who already has an authorized account trigger memory corruption over the network. The sources say this can lead to code execution, and the CVSS score is 7.5 (high).
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
Organizations that use Exchange Online (Microsoft 365 mailboxes) are the ones in scope, since the flaw is in Microsoft's hosted service. The sources do not describe which Exchange Online features or account roles are needed beyond being an authorized user. Self-hosted Exchange Server is not named in the sources.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| Microsoft Exchange Online | vendor | service (no build numbers listed) | mitigated service-side by Microsoft, 2026-10-22 |
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.
This page as .md · .json · in your agent: get_signal("CVE-2026-96185")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.