Microsoft · Security update · October 13, 2026
KB5128896: October 2026 security update
KB5128896, released October 13, 2026, fixes 5 CVEs in Microsoft Exchange Server 2019 Cumulative Update 15. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
5
1 rated Critical
Exploited
0
None reported
Exploitation more likely
2
Vendor assessment
Highest EPSS
0.0139
72nd percentile
Priority of the 5 CVEs
Patch now 0
Urgent 2
High 3
Routine 0
Applies to
CVEs this fix closes
| Priority | CVE | Component | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-70571 | Microsoft Exchange Server | Remote Code Execution | 8.1 | 0.0139 | More likely |
| Urgent | CVE-2026-70279 | Microsoft Exchange Server | Spoofing | 9.3 | 0.0129 | More likely |
| High | CVE-2026-77910 | Microsoft Exchange Server | Elevation of Privilege | 8.8 | 0.0087 | Exploitation Less Likely |
| High | CVE-2026-87696 | Microsoft Exchange Server | Elevation of Privilege | 7.5 | 0.0042 | Exploitation Less Likely |
| High | CVE-2026-87695 | Microsoft Exchange Server | Elevation of Privilege | 7.8 | 0.0029 | Exploitation Less Likely |
Showing 1 to 5 of 5
1