{"id":"CVE-2026-96185","kind":"vulnerability","aliases":["CVE-2026-96185"],"related":[],"title":"Microsoft Exchange Online: stack buffer overflow lets an authorized user run code","description":"Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.","summary":"A stack-based buffer overflow in Microsoft Exchange Online lets an attacker who already has an authorized account trigger memory corruption over the network. The sources say this can lead to code execution, and the CVSS score is 7.5 (high).","severity":"high","cvss":7.5,"epss":0.0054,"exploited":false,"exploited_at":null,"products":[{"name":"Microsoft Exchange Online","fixed":["mitigated service-side by Microsoft, 2026-10-22"],"affected":"service (no build numbers listed)","ecosystem":"vendor"}],"ecosystems":[],"tags":["cloud-service","exchange-online","microsoft-365","no-customer-action","vendor"],"not_affected_if":["on-premises-exchange-only","self-hosted-exchange-server"],"how_to_check":"Nothing to check: Exchange Online is Microsoft-hosted and was fixed by Microsoft. MSRC lists no build numbers and no tenant action.","fix":"No customer action. Microsoft states the vulnerability has already been fully mitigated service-side; there is no patch, version or tenant setting to change.","status":"resolved","published_at":"2026-10-22T22:19:53+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","triaged_at":"2026-10-25T03:15:03+00:00","updated_at":"2026-10-25T03:17:10+00:00","category":"vendor","confidence":0.9,"triage":{"at":"2026-10-25T03:15:03Z","model":"claude-haiku-5-5","output":{"fix":"- Microsoft runs Exchange Online as a hosted service, so no customer-side patch is documented in the sources.\n- Check the Microsoft Security Response Center advisory for CVE-2026-96185 for any tenant action required.","reach":"network","title":"Microsoft Exchange Online: stack buffer overflow lets an authorized user run code","impact":"high","summary":"A stack-based buffer overflow in Microsoft Exchange Online lets an attacker who already has an authorized account trigger memory corruption over the network. The sources say this can lead to code execution, and the CVSS score is 7.5 (high).","category":"vendor","nicknames":[],"who_cares":["exchange-online","microsoft-365"],"confidence":0.5,"needs_auth":"yes","worst_case":"attacker runs code on the Exchange Online service","analyst_note":"Check the Microsoft MSRC advisory for CVE-2026-96185 for affected scope, tenant actions and whether Microsoft has already mitigated it service-side.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["on-premises-exchange-only"],"who_is_affected":"Organizations that use Exchange Online (Microsoft 365 mailboxes) are the ones in scope, since the flaw is in Microsoft's hosted service. The sources do not describe which Exchange Online features or account roles are needed beyond being an authorized user. Self-hosted Exchange Server is not named in the sources.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"high"},"cost_usd":0.000603,"input_tokens":3298,"output_tokens":546,"severity_before":"high"},"analyst_status":"done","analyst_note":"Check the Microsoft MSRC advisory for CVE-2026-96185 for affected scope, tenant actions and whether Microsoft has already mitigated it service-side.","search":"'-2026':14A,17A '-365':29B '-96185':15A,18A '7.5':74B 'account':53B 'action':33B 'allow':85C 'alreadi':49B 'attack':47B,88C 'author':9A,52B,87C 'base':38B,78C 'buffer':5A,39B,79C 'cloud':23B 'cloud-servic':22B 'code':12A,67B,91C 'corrupt':56B 'custom':32B 'cve':13A,16A 'cvss':71B 'exchang':2A,26B,43B,83C 'exchange':20A 'exchange-onlin':25B 'execut':68B,90C 'high':75B 'lead':65B 'let':7A,45B 'memori':55B 'microsoft':1A,19A,28B,42B,82C 'network':59B,94C 'no-customer-act':30B 'onlin':3A,27B,44B,84C 'online':21A 'overflow':6A,40B,80C 'run':11A 'say':62B 'score':72B 'servic':24B 'sourc':61B 'stack':4A,37B,77C 'stack-bas':36B,76C 'trigger':54B 'user':10A 'vendor':34B","nicknames":[],"mitigations":[],"who_affected":"Organizations that use Exchange Online (Microsoft 365 mailboxes) are the ones in scope, since the flaw is in Microsoft's hosted service. The sources do not describe which Exchange Online features or account roles are needed beyond being an authorized user. Self-hosted Exchange Server is not named in the sources.","tier":"B","verified":{"fix":{"at":"2026-10-25T03:17:10Z","by":"analyst","run_id":686},"how_to_check":{"at":"2026-10-25T03:17:10Z","by":"analyst","run_id":686},"who_affected":{"at":"2026-10-25T03:17:10Z","by":"analyst","run_id":686}},"analyst_revisit_at":null,"first_public_at":"2026-10-22T22:19:53+00:00","kev":null,"cvss_vector":"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-96185","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-96185","severity":null,"published_at":"2026-10-22T22:19:53+00:00","modified_at":"2026-10-23T19:43:46+00:00","first_seen_at":"2026-10-23T21:57:32+00:00","fetched_at":"2026-10-23T22:29:03+00:00","note":null},{"source":"epss","external_id":"CVE-2026-96185","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-96185","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-24T07:15:51+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-96185:686","url":null,"severity":null,"published_at":"2026-10-25T03:17:10+00:00","modified_at":"2026-10-25T03:17:10+00:00","first_seen_at":"2026-10-25T03:17:10+00:00","fetched_at":"2026-10-25T03:17:10+00:00","note":"Read MSRC advisory: cloud service CVE, already fully mitigated by Microsoft, no customer action; not publicly disclosed, not exploited, no PoC. MSRC max severity Critical, CVSS 7.5 base/6.5 temporal (AV:N/AC:H/PR:L)."}],"documents":[{"id":3101,"url":"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96185","title":"MSRC: CVE-2026-96185 Microsoft Exchange Online Remote Code Execution Vulnerability","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}