Microsoft Exchange: critical remote code execution via Color Management (CVE-2026-96067)

What happened

On 10 November 2026, Microsoft disclosed CVE-2026-96067. Microsoft describes it as an integer overflow or wraparound in Microsoft Color Management that "allows an unauthorized attacker to execute code over a network". The vulnerability has a CVSS base score of 9.8, which is critical. According to the description, an attacker does not need to log in.

CISA does not list the vulnerability as exploited, and we know of no public reports of attacks. Microsoft has not published any technical details beyond this short description.

Who is affected

The source data lists Microsoft Exchange as the affected product. The vulnerable code is in the Microsoft Color Management component. Our data does not include the affected Exchange versions or Windows builds. Check Microsoft's advisory for CVE-2026-96067 (linked below) to see exactly which products and versions are affected and which updates fix them. The Microsoft page needs JavaScript, so open it in a normal browser.

If you do not run Microsoft Exchange or other Microsoft products listed in the advisory, this vulnerability does not affect you. Linux servers and web hosting stacks on Linux are not affected.

What to do now

1. Open Microsoft's advisory for CVE-2026-96067 and note which of your products and versions are listed, along with the matching security update (KB number).
2. Make sure you have a current backup of each affected Exchange server, or at least a recent snapshot, before you patch.
3. Install the security update from the advisory using Windows Update, WSUS or your patch management tool. For Exchange, also install any Exchange Security Update the advisory lists.
4. Restart the server if the update asks you to.
5. After the restart, check that the Exchange services are running (for example with Get-Service MSExchange* in PowerShell), and test OWA, mail flow and client connections.
6. If you have several Exchange servers, patch them one after another so mail keeps flowing.
7. Until all servers are patched, limit network access to them as much as you can. Expose only the services you really need to the internet.

How to check whether you are affected

• Compare your installed products and build numbers with the list in Microsoft's advisory. In the Exchange Management Shell, Get-ExchangeServer | Format-List Name,Edition,AdminDisplayVersion shows the Exchange build.
• Check whether the KB from the advisory is installed, for example with Get-HotFix -Id KBxxxxxxx in PowerShell, or look under the installed updates in Windows Update.
• If the update is missing, the server is vulnerable until you install it.

Sources

• https://nvd.nist.gov/vuln/detail/CVE-2026-96067
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96067