Microsoft · Security update · October 13, 2026
KB5128898: October 2026 security update
KB5128898, released October 13, 2026, fixes 6 CVEs in Microsoft Exchange Server 2016 Cumulative Update 23. None of them is reported as exploited. Patch Radar priority: Urgent.
Urgent
CVEs closed
6
1 rated Critical
Exploited
0
None reported
Exploitation more likely
2
Vendor assessment
Highest EPSS
0.0231
83rd percentile
Priority of the 6 CVEs
Patch now 0
Urgent 2
High 4
Routine 0
Applies to
CVEs this fix closes
| Priority | CVE | Component | Impact | CVSS | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| Urgent | CVE-2026-70571 | Microsoft Exchange Server | Remote Code Execution | 8.1 | 0.0139 | More likely |
| Urgent | CVE-2026-70279 | Microsoft Exchange Server | Spoofing | 9.3 | 0.0129 | More likely |
| High | CVE-2026-87692 | Microsoft Exchange Server | Elevation of Privilege | 7.8 | 0.0231 | Exploitation Less Likely |
| High | CVE-2026-77910 | Microsoft Exchange Server | Elevation of Privilege | 8.8 | 0.0087 | Exploitation Less Likely |
| High | CVE-2026-87696 | Microsoft Exchange Server | Elevation of Privilege | 7.5 | 0.0042 | Exploitation Less Likely |
| High | CVE-2026-87695 | Microsoft Exchange Server | Elevation of Privilege | 7.8 | 0.0029 | Exploitation Less Likely |
Showing 1 to 6 of 6
1