CVE-2026-96940: Microsoft Exchange Weak Authorization Flaw — Detection, Hunting, and Remediation Guide

Out-of-band releases from Microsoft are not routine. They are reserved for issues Microsoft considers urgent enough to break the Patch Tuesday cadence. Treat this one accordingly.

---
title: Exchange IIS Worker Process Spawning Shell or Script Interpreter
id: 9f2c7a41-3b8e-4d5a-9c1f-6e7d8a2b3c4d
status: experimental
description: Detects the Exchange IIS worker process (w3wp.exe in MSExchange app pools) spawning command shells or script interpreters, consistent with post-exploitation following Exchange server compromise such as CVE-2026-96940 privilege escalation chains.
references:
  - https://thehackernews.com/2026/10/microsoft-exchange-flaw-lets.html
  - https://attack.mitre.org/techniques/T1059/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.execution
  - attack.t1059
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection_parent:
    ParentImage|endswith: '\w3wp.exe'
    ParentCommandLine|contains:
      - 'MSExchange'
  selection_child:
    Image|endswith:
      - '\cmd.exe'
      - '\powershell.exe'
      - '\pwsh.exe'
      - '\cscript.exe'
      - '\wscript.exe'
      - '\mshta.exe'
      - '\rundll32.exe'
      - '\net.exe'
      - '\net1.exe'
      - '\whoami.exe'
  condition: selection_parent and selection_child
falsepositives:
  - Rare; Exchange app pools should never legitimately spawn shells. Investigate any hit.
level: high
---
title: Exchange IIS Log Cross-Mailbox EWS Access Pattern
id: 4b6e1d92-7a3c-4f8b-b5e2-1c9d0e3f5a6b
status: experimental
description: Detects authenticated EWS or OWA requests where the requested mailbox parameter differs from the authenticated user, a pattern consistent with weak-authorization cross-mailbox access attempts such as CVE-2026-96940 exploitation.
references:
  - https://thehackernews.com/2026/10/microsoft-exchange-flaw-lets.html
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.collection
  - attack.t1114
  - attack.valid_accounts
  - attack.t1078
logsource:
  category: webserver
  product: windows
  service: iis
detection:
  selection_uri:
    cs-uri-stem|contains:
      - '/ews/exchange.asmx'
      - '/owa/'
  selection_mbx:
    cs-uri-query|contains:
      - 'mbx='
      - 'mailbox='
      - 'smtp='
  filter_own:
    cs-uri-query|contains|windash: ''
  condition: selection_uri and selection_mbx and not filter_own
falsepositives:
  - Legitimate delegate access (admin assistants, shared mailboxes) - baseline known delegations and whitelist authorized delegate pairs
  - Service accounts with ApplicationImpersonation roles - document and suppress per-account
level: medium
---
title: Exchange Impersonation or Delegation Privilege Modification
id: 2d8f4a15-6c9b-4e7d-a3f1-8b2c5d6e7f90
status: experimental
description: Detects PowerShell execution of Exchange cmdlets that grant mailbox permissions, impersonation roles, or send-on-behalf rights - a common persistence mechanism after privilege escalation on Exchange servers.
references:
  - https://thehackernews.com/2026/10/microsoft-exchange-flaw-lets.html
  - https://attack.mitre.org/techniques/T1098/
author: Security Arsenal
date: 2026/10/15
tags:
  - attack.persistence
  - attack.t1098
  - attack.privilege_escalation
logsource:
  category: process_creation
  product: windows
detection:
  selection:
    CommandLine|contains:
      - 'Add-MailboxPermission'
      - 'New-ManagementRoleAssignment'
      - 'ApplicationImpersonation'
      - 'Add-ADPermission'
      - 'GrantSendOnBehalfTo'
      - '-AccessRights FullAccess'
  condition: selection
falsepositives:
  - Legitimate Exchange administration - alert should route to change-management correlation; verify against approved change tickets
level: high

// Hunt 1: Single identity or source IP accessing an abnormal volume of distinct mailboxes via EWS/OWA
// Requires IIS logs from Exchange servers ingested into W3CIISLog (or adjust table name to your ingestion path)
let TimeWindow = 24h;
let DistinctMailboxThreshold = 15;  // Tune per environment; executives' assistants legitimately touch a handful
W3CIISLog
| where TimeGenerated > ago(TimeWindow)
| where csUriStem has_any ("/ews/exchange.asmx", "/owa/")
| where isnotempty(csUserName) and csUserName != "-"
| extend RequestedMailbox = tostring(extract(@"(?i)(?:mbx|mailbox|smtp)=([^&]+)", 1, csUriQuery))
| where isnotempty(RequestedMailbox)
| where RequestedMailbox !contains csUserName  // requested mailbox differs from authenticated identity
| summarize DistinctMailboxes = dcount(RequestedMailbox),
            Mailboxes = make_set(RequestedMailbox, 50),
            SourceIPs = make_set(cIP, 10),
            FirstSeen = min(TimeGenerated),
            LastSeen = max(TimeGenerated)
    by csUserName, Computer
| where DistinctMailboxes >= DistinctMailboxThreshold
| order by DistinctMailboxes desc;

// Hunt 2: Exchange delegation / impersonation privilege grants (post-escalation persistence)
// Uses OfficeActivity (Exchange admin audit) if connected, else falls back to Windows process events
OfficeActivity
| where TimeGenerated > ago(7d)
| where Operation in~ ("Add-MailboxPermission", "New-ManagementRoleAssignment",
                       "Set-Mailbox", "Add-ADPermission", "New-ManagementRole")
| extend Parameters = tostring(Parameters)
| where Parameters has_any ("FullAccess", "ApplicationImpersonation", "GrantSendOnBehalfTo", "AccessRights")
| project TimeGenerated, UserId, Operation, Parameters, ClientIP, ResultStatus
| order by TimeGenerated desc;

// Hunt 3: Exchange w3wp.exe spawning suspicious child processes (post-exploitation)
DeviceProcessEvents
| where TimeGenerated > ago(7d)
| where InitiatingProcessFileName =~ "w3wp.exe"
| where InitiatingProcessCommandLine has "MSExchange"
| where FileName in~ ("cmd.exe", "powershell.exe", "pwsh.exe", "cscript.exe",
                      "wscript.exe", "mshta.exe", "rundll32.exe", "net.exe",
                      "whoami.exe", "nltest.exe", "adfind.exe")
| project TimeGenerated, DeviceName, FileName, ProcessCommandLine,
          InitiatingProcessCommandLine, AccountName
| order by TimeGenerated desc;

-- Hunt: Exchange w3wp.exe child processes and active 443 sessions on Exchange servers
-- Deploy as a hunt scoped to your Exchange server group

LET procs = SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE Name =~ '(?i)w3wp|cmd|powershell|pwsh|cscript|wscript|mshta|rundll32'

LET suspicious_children = SELECT Pid, Ppid, Name, CommandLine, Username, CreateTime,
       get(field='Cmdline') AS FullCmd
FROM pslist()
WHERE Ppid IN (SELECT Pid FROM pslist() WHERE Name =~ '(?i)w3wp')
  AND Name =~ '(?i)cmd|powershell|pwsh|cscript|wscript|mshta|rundll32|net|whoami'

LET exchange_listeners = SELECT Pid, Name, LocalAddr, LocalPort, RemoteAddr, RemotePort, Status
FROM netstat()
WHERE LocalPort IN (443, 444) AND Status =~ '(?i)ESTABLISHED|LISTEN'

SELECT * FROM suspicious_children
UNION ALL
SELECT NULL AS Pid, NULL AS Ppid, Name, NULL AS CommandLine, NULL AS Username,
       NULL AS CreateTime,
       format(format='listener %v:%v -> %v:%v [%v]',
              args=[LocalAddr, LocalPort, RemoteAddr, RemotePort, Status]) AS FullCmd
FROM exchange_listeners

# --- CVE-2026-96940 verification and hardening script ---
# 1. Report Exchange build so you can confirm SU application against the MSRC advisory
Write-Host "=== Exchange Build Inventory ===" -ForegroundColor Cyan
Get-Command Exsetup.exe | ForEach-Object { $_.FileVersionInfo } |
  Select-Object ProductVersion, FileVersion | Format-List

# Also pull installed Exchange updates from the registry (more reliable than Exsetup alone)
Get-ItemProperty HKLM:\SOFTWARE\Microsoft\ExchangeServer\v15\Setup -ErrorAction SilentlyContinue |
  Select-Object MsiProductMajor, MsiProductMinor, MsiBuildMajor, MsiBuildMinor
Get-HotFix | Where-Object { $_.Description -match 'Security Update' } |
  Sort-Object InstalledOn -Descending | Select-Object -First 10 HotFixID, Description, InstalledOn

# 2. Confirm mailbox audit logging is enabled org-wide (critical for detecting cross-mailbox access)
Write-Host "`n=== Mailbox Audit Logging Status ===" -ForegroundColor Cyan
$orgConfig = Get-OrganizationConfig
if (-not $orgConfig.AuditDisabled) {
  Write-Host "Org-level mailbox auditing: ENABLED" -ForegroundColor Green
} else {
  Write-Host "Org-level mailbox auditing: DISABLED - enabling now" -ForegroundColor Red
  Set-OrganizationConfig -AuditDisabled $false
}

# 3. Enforce per-mailbox auditing and flag any mailbox with auditing off
$unaudited = Get-Mailbox -ResultSize Unlimited | Where-Object { -not $_.AuditEnabled }
if ($unaudited) {
  Write-Host "Enabling auditing on $($unaudited.Count) mailboxes..." -ForegroundColor Yellow
  $unaudited | Set-Mailbox -AuditEnabled $true
}

# 4. Inventory dangerous delegations - review every entry in this output manually
Write-Host "`n=== FullAccess Delegations (review all) ===" -ForegroundColor Cyan
Get-Mailbox -ResultSize Unlimited | Get-MailboxPermission |
  Where-Object { $_.AccessRights -match 'FullAccess' -and $_.IsInherited -eq $false -and $_.User -notmatch 'NT AUTHORITY' } |
  Select-Object Identity, User, AccessRights | Format-Table -AutoSize

Write-Host "`n=== ApplicationImpersonation Role Assignments (review all) ===" -ForegroundColor Cyan
Get-ManagementRoleAssignment -Role ApplicationImpersonation |
  Select-Object Name, RoleAssignee, RoleAssigneeType | Format-Table -AutoSize

# 5. Confirm Extended Protection is enabled (mitigates auth relay against Exchange)
Write-Host "`n=== Extended Protection Check ===" -ForegroundColor Cyan
Import-Module WebAdministration
Get-WebConfigurationProperty -Filter "system.webServer/security/authentication/windowsAuthentication" `
  -PSPath "IIS:\Sites\Default Web Site\EWS" -Name extendedProtection -ErrorAction SilentlyContinue |
  Select-Object @{n='ExtendedProtection';e={$_.tokenChecking}}

Write-Host "`nDone. Cross-reference build against MSRC CVE-2026-96940 advisory for SU confirmation." -ForegroundColor Cyan