Microsoft's Security Update Guide published it on 22 October 2026 at 07:00 US Pacific time (14:00 UTC; 10:00 pm Perth) CVE-2026-96185, 'Microsoft Exchange Online Remote Code Execution Vulnerability': a stack-based buffer overflow (CWE-121) in Microsoft Exchange Online allows an authorised attacker to execute code over a network. Microsoft rates it Critical with a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H).

Microsoft's FAQ says the vulnerability has already been fully mitigated by Microsoft, there is no action for users of the service to take, and the CVE is published to provide further transparency.

Microsoft lists it as not publicly disclosed and not exploited. It was one of six Microsoft cloud-service CVEs published that day; the others are on their own desk cards. Primary: Microsoft Security Response Center; CVE record.