CVE-2026-96185
Microsoft — Microsoft Exchange Online Remote Code Execution Vulnerability
Microsoft
Patch Tuesday
10
EVRS 10 of 100 Elevated
Scheduled Maintenance
Rank 2,665 of 2,962 tracked
Why it scores 10
Evidence available: 4 of 8 signalsCVSS base score 7.5.
- CISA KEVDid not apply
- RansomwareNo data
- Vendor exploitationDid not apply
- EPSSNo data
- Microsoft Exploitability IndexNo data
- Pre-patch disclosureDid not apply
- KEV recencyNo data
- CVSSApplied
The band answers “how soon”, not “how bad”. No data for: Ransomware, EPSS, Microsoft Exploitability Index, KEV recency. Why some signals show no data
Fix
No fixed version identified yetNo fix or affected-version data for this CVE yet.
Evidence
Each value with its source| Measure | Value | Source |
|---|---|---|
| CVSS base scoreHow severe the flaw is in itself. It does not say how likely an attack is. | 7.5 | NVD |
| FIRST EPSSFIRST's estimate of the chance this is exploited in the next 30 days, and how that ranks against all CVEs. | Not published | FIRST EPSS |
| Actively exploitedWhether a source of record has confirmed attacks using it in the wild. | Not confirmed | Patch Tuesday |