Microsoft has fixed a critical vulnerability in Exchange Online that allowed remote code execution (RCE), the company has said. The flaw is tracked as CVE-2026-96185 and affected Microsoft’s own cloud email service.
According to Microsoft, the issue was a stack-based buffer overflow that could let an authorized attacker execute code. The company shares no further technical details. Because the fix is already in place, Microsoft says customers do not need to take any action.
Microsoft thanked four students from the University of Illinois Urbana-Champaign for reporting the vulnerability. Their report helped get the flaw closed.
The case also recalls 2023, when Exchange Online was hit by a large-scale hack. Attackers then gained access to the accounts of various organizations, including governments in Europe and the United States.
Even when a provider patches a flaw for you, cloud email remains a high-value target. Make sure you know which cloud services your organization depends on, and keep your own vulnerability and incident processes up to date. Review whether your monitoring would flag unusual account activity.
Read msrc.microsoft.com article for more information.
