微软发布了紧急的Exchange安全更新

2026年10月6日

执行摘要

微软发布了一个紧急的Exchange Server安全更新，以解决CVE-2026-96940，这是一个特权提升漏洞，可能允许经过身份验证的攻击者访问同一Exchange组织内其他用户的电子邮件和附件。微软表示，目前尚未发现该漏洞的主动利用。然而，该公司在正常更新周期之外发布了修复程序，并建议尽早应用。

CVE-2026-96940

CVE-2026-96940影响Microsoft Exchange Server，可能允许经过身份验证的攻击者访问其他用户的邮箱数据。潜在的暴露包括：

- 电子邮件

- 电子邮件附件

- 内部通信

- 其他敏感的邮箱信息

攻击者必须已经通过身份验证，并且该漏洞不提供跨租户访问。微软在内部发现了此问题，目前尚未报告有主动利用的情况。微软通常在其定期服务周期内发布Exchange安全更新。此漏洞获得了紧急修复，表明微软认为及时修复的重要性足以不必等待下一个常规更新周期。

Exchange服务器仍然是有吸引力的目标，因为它们包含大量敏感的组织信息。能够跨越正常邮箱访问边界的漏洞因此值得及时关注，即使没有确认的利用。

受影响版本

该更新适用于：

- Exchange Server Subscription Edition RTM

- Exchange Server 2019 CU14

- Exchange Server 2019 CU15

- Exchange Server 2016 CU23

微软还发布了相关安全更新的V2版本。关键更新包括：

- KB5129955 — Exchange Server Subscription Edition

- KB5129956 — Exchange Server 2019 CU15

- KB5129957 — Exchange Server 2019 CU14

组织应验证他们已安装最新的适用更新，而不是依赖于原始包。

Exchange 2016和2019的考虑

Exchange Server 2016和Exchange Server 2019已经不再提供主流支持。安全更新仍然通过微软的扩展安全更新（ESU）计划提供给符合条件的组织。仍在使用这些版本的组织应利用此期间加快向Exchange Server Subscription Edition的迁移。

更新后的检查

微软记录了一些管理员在部署后应考虑的问题，包括涉及已发布日历和某些混合空闲/忙碌场景的问题。

安装更新后，管理员应：

- 验证Exchange构建号。

- 运行Exchange Server健康检查器。

- 确认邮件流。

- 测试Outlook、OWA和ECP访问。

- 验证日历功能。

- 检查混合空闲/忙碌功能（如适用）。

- 审查Exchange日志和身份验证活动以查找异常行为。

安全团队应做的事情

运行本地Exchange的组织应将此视为高优先级的修补活动。

首先识别所有Exchange服务器及其当前构建。优先处理外部可访问的系统，应用适当的V2安全更新，并在安装后验证环境。

尽管目前没有确认的利用，但经过身份验证的访问、潜在的邮箱数据暴露以及微软决定发布紧急修复的组合使得该漏洞值得迅速处理。

对于Exchange管理员来说，这不是一个可以留在待办事项中的补丁。

相关漏洞

CVE-2026-88779 CVSS 8.7 HIGH Analyzed

CVE-2026-88779 - Citrix NetScaler Improper Restriction of Operations within the Bounds of a Memory Buffer Vulnerability - [Actively Exploited]

Vulnerability in NetScaler ADC and NetScaler Gateway. This issue affects ADC: before 14.1-73.41, before 13.1-64.28, before 14.1-73.41 FIPS, and before 13.1-37.282; Gateway: before 14.1-73.41 and before 13.1-64.28.

CVE-2026-96940 CVSS 8.8 HIGH Undergoing Analysis

CVE-2026-96940 - Microsoft Exchange Server Elevation of Privilege Vulnerability

An elevation of privilege vulnerability exists when Microsoft Exchange Outlook Web Access (OWA) fails to properly handle web requests. An attacker who successfully exploited this vulnerability could perform script/content injection attacks and attempt to trick the user into disclosing sensitive information. To exploit the vulnerability, an attacker could send a specially crafted email message containing a malicious link to a user. Alternatively, an attacker could use a chat client to social engineer a user into clicking the malicious link. The security update addresses the vulnerability by correcting how Microsoft Exchange validates web requests. Note: In order to exploit this vulnerability, a user must click a maliciously crafted link from an attacker.

CVE-2026-90970 CVSS 9.9 CRITICAL Awaiting Analysis

CVE-2026-90970 - Improper Neutralization of Special Elements Used in a Template Engine in GitLab AI Gateway

GitLab has remediated a vulnerability in the GitLab AI Gateway component affecting all versions of the AI Gateway from 18.1.6 before 19.2.4, 19.3 before 19.3.2, and 19.4 before 19.4.1 that, under certain conditions, could have allowed an authenticated user with Duo Agent Platform access to escape the prompt template sandbox via a specially crafted flow configuration, resulting in arbitrary command execution on the AI Gateway.

CVE-2026-104286 CVSS 9.8 CRITICAL Analyzed

CVE-2026-104286 - Fortinet FortiMail Path Traversal Vulnerability - [Actively Exploited]

An improper limitation of a pathname to a restricted directory ('path traversal') vulnerability in Fortinet FortiMail 8.0.0 through 8.0.1, FortiMail 7.6.0 through 7.6.6, FortiMail 7.4.0 through 7.4.8, FortiMail 7.2.0 through 7.2.9 may allow an unauthenticated attacker to write arbitrary files on the underlying system via crafted HTTP or HTTPS requests.

CVE-2026-76504 CVSS 9.8 CRITICAL Analyzed

CVE-2026-76504 - Cisco Catalyst SD-WAN Manager Hex Encoding Vulnerability - [Actively Exploited]

A vulnerability in the API session-based authentication management of Cisco Catalyst SD-WAN Manager could allow an unauthenticated, remote attacker to access an affected system with privileges of the admin user. This vulnerability is due to improper handling of URI encoding in an HTTP request, which allows the request to bypass an authentication rule that is intended to restrict access to a specific API endpoint. An attacker could exploit this vulnerability by sending a crafted HTTP request to the API of the affected system. A successful exploit could allow the attacker to bypass authentication and gain access to the API as the admin user.

微软发布了紧急的Exchange安全更新

相关漏洞

更多来自 TheCyberThrone