---
id: "CVE-2026-96185"
kind: "vulnerability"
aliases: ["CVE-2026-96185"]
title: "Microsoft Exchange Online: stack buffer overflow lets an authorized user run code"
severity: "high"
cvss: 7.5
epss: 0.0054
exploited: false
status: "resolved"
category: "vendor"
products: [{"name": "Microsoft Exchange Online", "fixed": ["mitigated service-side by Microsoft, 2026-10-22"], "affected": "service (no build numbers listed)", "ecosystem": "vendor"}]
ecosystems: []
tags: ["cloud-service", "exchange-online", "microsoft-365", "no-customer-action", "vendor"]
not_affected_if: ["on-premises-exchange-only", "self-hosted-exchange-server"]
published_at: "2026-10-22T22:19:53+00:00"
first_seen_at: "2026-10-23T21:57:32+00:00"
updated_at: "2026-10-25T03:17:10+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-96185", "first_seen_at": "2026-10-23T21:57:32+00:00"}, {"source": "epss", "url": "https://api.first.org/data/v1/epss?cve=CVE-2026-96185", "first_seen_at": "2026-10-24T07:15:51+00:00"}, {"source": "analyst", "url": null, "first_seen_at": "2026-10-25T03:17:10+00:00"}]
---

# Microsoft Exchange Online: stack buffer overflow lets an authorized user run code

A stack-based buffer overflow in Microsoft Exchange Online lets an attacker who already has an authorized account trigger memory corruption over the network. The sources say this can lead to code execution, and the CVSS score is 7.5 (high).

_Summary, check and fix written by a model from the sources; labelled as such._

## Affected

- vendor:Microsoft Exchange Online affected service (no build numbers listed) fixed mitigated service-side by Microsoft, 2026-10-22

## How to check

Nothing to check: Exchange Online is Microsoft-hosted and was fixed by Microsoft. MSRC lists no build numbers and no tenant action.

## Fix

No customer action. Microsoft states the vulnerability has already been fully mitigated service-side; there is no patch, version or tenant setting to change.

## Timeline

- 2026-10-23T21:57:32+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-96185
- 2026-10-24T07:15:51+00:00 epss https://api.first.org/data/v1/epss?cve=CVE-2026-96185
- 2026-10-25T03:17:10+00:00 analyst — Read MSRC advisory: cloud service CVE, already fully mitigated by Microsoft, no customer action; not publicly disclosed, not exploited, no PoC. MSRC max severity Critical, CVSS 7.5 base/6.5 temporal (AV:N/AC:H/PR:L).

## Documents

- [advisory] MSRC: CVE-2026-96185 Microsoft Exchange Online Remote Code Execution Vulnerability https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96185

## From the sources

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_