Why this update matters
Microsoft has issued a revised, “V2” version of its September 2026 Exchange Server security update. If your organization runs Exchange Server on-premises — including in a hybrid configuration alongside Exchange Online — this update deserves prompt attention, because it closes a gap left by the original September release. This article summarizes what Microsoft has confirmed about the V2 update, which Exchange versions are affected, what’s known about the vulnerability itself, and what hybrid and Exchange Online customers need to know.
What changed between the original release and V2
According to Microsoft’s Exchange Team, the September 2026 security updates were initially released earlier in the month, but a second version — V2 — was subsequently published. Microsoft states the difference between the original release and V2 is the addition of a fix for CVE-2026-96940. In other words, organizations that installed only the original September 2026 security update did not receive protection against this specific vulnerability; they need to install the V2 release to be covered.
Microsoft also notes that this particular update was published ahead of its originally intended schedule, and recommends that customers review the deployment guidance and apply the update at the earliest opportunity.
Which Exchange Server versions are affected
Microsoft’s guidance specifies that security updates are available for the following versions:
- Exchange Server Subscription Edition (SE) — RTM
- Exchange Server 2019 — Cumulative Update 14 (CU14) and Cumulative Update 15 (CU15)
- Exchange Server 2016 — Cumulative Update 23 (CU23)
There’s an important licensing distinction here. Exchange Server 2016 and 2019 are documented as out of support. Microsoft states that only organizations enrolled in the Period 2 Extended Security Update (ESU) program are eligible to receive Exchange 2016 and 2019 security updates released between May and October 2026 — which includes this V2 update. Organizations that have not enrolled in Period 2 ESU will not receive these updates for 2016 or 2019 and, per Microsoft’s guidance, should plan to migrate to Exchange Server SE to continue receiving security updates.
If your organization has already purchased Period 2 ESU coverage and needs help accessing the latest updates, Microsoft directs customers to contact the Exchange and Skype for Business Server ESU inquiry mailbox referenced in its announcement.
What’s known about CVE-2026-96940
Microsoft’s announcement is limited in detail on the vulnerability itself, directing administrators to the Security Update Guide for CVE-specific technical information (filtering on “Server Software” for Exchange SE, or “ESU” for Exchange 2016/2019). On the exploitability question, Microsoft states that it identified the vulnerability internally and is not aware of active exploitation at the time of publication.
Microsoft does not describe a formal exploitability index rating in this announcement. Administrators who need the complete technical severity and exploitability classification should consult the Security Update Guide entry for this CVE directly, since that level of detail isn’t part of the blog post itself.
Exchange Online: already protected, no customer action required
For organizations running Exchange Online, or Exchange in a hybrid configuration, Microsoft’s guidance is direct: Exchange Online customers are already protected from the vulnerabilities addressed by these security updates and do not need to take any action, other than updating any on-premises Exchange servers or Exchange Management Tools workstations that exist in their environment.
In practice, this means the protection for the cloud-hosted mailbox service has been applied on Microsoft’s side, independent of whether a hybrid organization’s on-premises servers have been patched yet. However, Microsoft is clear that this does not remove the need to patch on-premises Exchange servers — including servers that exist only for management purposes in an otherwise cloud-based environment.
Microsoft’s FAQ specifically addresses hybrid deployments: organizations in hybrid mode with Exchange Online still need to install the security update on their Exchange servers, even if those servers are used only for management tooling rather than hosting mailboxes. Microsoft also notes that if the authentication certificate is changed as part of installing the update, administrators should re-run the Hybrid Configuration Wizard afterward.
Known issues and resolved issues in this release
Microsoft’s release notes list two known issues that remain unresolved as of this update:
- Published calendar (.ics) files return an HTTP 500 error for calendar applications — Microsoft states this will be addressed in a future update.
- A ContentEngine deadlock caused by missing Korean WordBreaker rule files affects organizations with Korean-language email — also slated for a future fix.
Two issues are listed as resolved in this release:
- Wrapper messages appearing in shared mailbox inboxes in hybrid environments.
- Availability (free/busy) failures for delegated mailboxes in Exchange hybrid deployments that use the Graph API only.
How to install the update
Microsoft outlines a general update path for applying this security update:
- Inventory your servers. Use the Exchange Server Health Checker script to confirm which servers are behind on cumulative updates (CUs), security updates (SUs), or required manual actions.
- Ensure you’re on a supported CU. The Exchange Update Wizard can help determine the correct path if you first need to move to a CU that supports this security update.
- Reboot and verify services after installation. Microsoft notes that if some Exchange services remain disabled after a reboot, this indicates the installation was interrupted, and points to documented workaround guidance for that scenario.
- Use SetupAssist if you hit errors. For installation failures, Microsoft recommends running the SetupAssist script, with additional guidance available for repairing failed cumulative or security update installations.
Microsoft also confirms that security updates are cumulative: if you’re running a CU that the SU supports, you do not need to install prior SUs or hotfix updates in sequence — installing the latest one is sufficient.
Practical recommendations for SMB administrators
The following points are practical guidance based on the documented facts above, not separate Microsoft requirements:
- Confirm you have V2, not the original September release. Given that the only difference is the CVE-2026-96940 fix, check the installed update against the KB reference in Microsoft’s download article rather than assuming the original September patch is sufficient.
- Don’t assume hybrid means no on-premises work. Even organizations that are primarily cloud-based with Exchange Online still need to patch any remaining on-premises Exchange servers, including management-only servers, per Microsoft’s FAQ guidance.
- Check your ESU enrollment status if running 2016 or 2019. Since these versions are out of support and only receive security updates through the Period 2 ESU program, confirm enrollment status before assuming this patch is available to your environment.
- Treat the “ahead of schedule” release as a signal of urgency. Microsoft’s own language — recommending customers “apply the update at the earliest opportunity” — suggests this release warrants faster-than-usual patch testing and deployment cycles for organizations that haven’t already applied it.
- Avoid uninstalling the security update if issues arise. Microsoft states it does not recommend uninstalling security updates, and instead points administrators to documented troubleshooting resources.
Conclusion
The September 2026 V2 Exchange Server security update is a narrow but important revision: it specifically adds protection against CVE-2026-96940 that was absent from the original September release. Exchange Online customers can treat the cloud side of this as already handled, but hybrid and on-premises Exchange administrators — particularly those running Exchange 2016 or 2019 under Period 2 ESU, or Exchange Server SE — should verify their patch level against the V2 release and apply it promptly given Microsoft’s own characterization of the update’s accelerated timing. As always, this article is a draft summary of Microsoft’s published guidance and should be reviewed against Microsoft’s official Security Update Guide and KB article before making deployment decisions.