Locating Exchange servers that match the CVE-2026-96940 advisory scope

The advisory scope

Microsoft shipped a V2 release of its September 2026 Exchange Server security updates. The only change against the original release is the addition of CVE-2026-96940. The Exchange Team states it identified the vulnerability internally and is not aware of active exploitation. The V2 updates cover Exchange Server Subscription Edition (SE) RTM, Exchange Server 2019 CU14 and CU15, and Exchange Server 2016 CU23. Exchange 2016 and Exchange 2019 have left mainstream support, so only organisations enrolled in the Period 2 Extended Security Update (ESU) programme, which covers updates released between May and October 2026, can download those fixes.

Version hunting across the covered lines

The covered range spans four product-and-build combinations across three product names. A search that only looks for one of them will under-report, so the inventory query should match Subscription Edition RTM, 2019 CU14, 2019 CU15 and 2016 CU23 explicitly.

Using ZoomEye to size the wider surface

The product fingerprint app="Microsoft Exchange Server" matched 1,098,562 assets in ZoomEye International on 2026-10-03. Product matches describe reachable Exchange deployments, not hosts confirmed vulnerable to CVE-2026-96940.

Turning exposure data into an internal list

External counts show how common the product fingerprint is; they do not identify your servers. The bridge between the two is an internal build report, cross-checked against the ESU enrolment state so each server maps to a package that is actually downloadable.

Where ESU boundaries matter

Servers outside the Extended Security Update programme cannot receive the V2 packages for the older lines. Those hosts belong in a migration track rather than a patch track, and the distinction should be visible in the same inventory.

Action

Install this Exchange security update now. Open the Microsoft Security Update Guide, identify the build that matches each server, apply the cumulative package, reboot, and confirm that every Exchange service came back up.

References

Reported by SecurityOnline.info, which summarises the Exchange Team announcement of the September 2026 V2 security updates.