← Lark216 Home

Microsoft Update Intelligence

Administrator notices from Microsoft, summarised: what changed, and what you should do.

1Action Required 455Review Recommended
Microsoft Services 1
Product families
Microsoft 365
Clear
Needs Attention All Updates
39 results · clear filters
Advanced Filters
Informational

Microsoft Purview: Data Lifecycle Management- Azure PST Import

Azure PST Import allows PST files stored in Azure Blob Storage to be imported into Exchange Online mailboxes, following a two-step process.

Azure · m365-roadmap Original Microsoft announcement ↗
Details

Original Microsoft text

Azure PST Import is a migration method that enables PST files stored in Azure Blob Storage to be imported directly into Exchange Online mailboxes. It follows the standard two‑step Exchange Migration Service pattern: an initial analysis phase to validate and assess PST data, followed by execution of the actual migration. The process also involves creating a migration endpoint, running an analysis-only migration batch, using the analysis results to configure the final batch, and then starting the batch to import PST content into target mailboxes. GA date: January CY2027 Preview date: October CY2…

Type
M365 Roadmap
Services
Exchange Online
Tags
In development, General Availability, Preview, Worldwide (Standard Multi-Tenant), Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · possibly affects Exchange Online · verify against the original
Informational

Microsoft Purview: Data Lifecycle Management - Azure PST Import

Azure PST Import allows PST files stored in Azure Blob Storage to be imported into Exchange Online mailboxes, following a two-step process.

Azure · m365-roadmap Original Microsoft announcement ↗
Details

Original Microsoft text

Azure PST Import is a migration method that enables PST files stored in Azure Blob Storage to be imported directly into Exchange Online mailboxes. It follows the standard two‑step Exchange Migration Service pattern: an initial analysis phase to validate and assess PST data, followed by execution of the actual migration. The process also involves creating a migration endpoint, running an analysis-only migration batch, using the analysis results to configure the final batch, and then starting the batch to import PST content into target mailboxes. GA date: March CY2027

Type
M365 Roadmap
Services
Exchange Online
Tags
In development, General Availability, GCC, GCC High, DoD, Microsoft Purview, Web
AI analysis
Low priority · generated by qwen2.5:7b · possibly affects Azure, Exchange Online · verify against the original
Review Recommended

CVE-2026-96185: Microsoft Exchange Online Remote Code Execution Vulnerability

A critical security vulnerability in Microsoft Exchange Online allows authorized attackers to execute code over a network via a stack-based buffer overflow.

What you should do

Apply the security update as soon as possible to mitigate the vulnerability. AI-suggested

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Stack-based buffer overflow in Microsoft Exchange Online allows an authorized attacker to execute code over a network.

Severity
Critical · CVSS 7.5
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Online, Remote Code Execution, 2026-Oct
AI analysis
Critical priority · generated by qwen2.5:7b · possibly affects Exchange Online · verify against the original
Not analysed

CVE-2026-87696: Microsoft Exchange Server Elevation of Privilege Vulnerability

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Improper verification of cryptographic signature in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Severity
Important · CVSS 7.5
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Elevation of Privilege, 2026-Oct
Not analysed

CVE-2026-87695: Microsoft Exchange Server Elevation of Privilege Vulnerability

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Inclusion of functionality from untrusted control sphere in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Severity
Important · CVSS 7.8
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Elevation of Privilege, 2026-Oct
Not analysed

CVE-2026-87692: Microsoft Exchange Server Elevation of Privilege Vulnerability

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Deserialization of untrusted data in Microsoft Exchange Server allows an authorized attacker to elevate privileges locally.

Severity
Important · CVSS 7.8
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Elevation of Privilege, 2026-Oct
Not analysed

CVE-2026-83843: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

Windows · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Out-of-bounds read in Windows Internet Key Exchange (IKE) Protocol allows an unauthorized attacker to deny service over a network.

Severity
Important · CVSS 7.5
Type
Security updates
Services
Exchange Online
Tags
Windows Internet Key Exchange (IKE) Protocol, Denial of Service, 2026-Oct
Not analysed

CVE-2026-83795: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

Windows · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Heap-based buffer overflow in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

Severity
Important · CVSS 7.5
Type
Security updates
Services
Exchange Online
Tags
Windows IKE Extension, Denial of Service, 2026-Oct
Not analysed

CVE-2026-83685: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

Buffer over-read in Windows IKE Extension allows an authorized attacker to deny service over a network.

Windows · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Buffer over-read in Windows IKE Extension allows an authorized attacker to deny service over a network.

Severity
Important · CVSS 6.5
Type
Security updates
Services
Exchange Online
Tags
Windows IKE Extension, Denial of Service, 2026-Oct
Not analysed

CVE-2026-77910: Microsoft Exchange Server Elevation of Privilege Vulnerability

Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Incorrect authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Severity
Important · CVSS 8.8
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Elevation of Privilege, 2026-Oct
Review Recommended

CVE-2026-70571: Microsoft Exchange Server Remote Code Execution Vulnerability

A critical security vulnerability in Microsoft Exchange Server allows remote code execution, which could be exploited by unauthorized attackers.

What you should do

Apply the security update as soon as possible to mitigate the risk of remote code execution. AI-suggested

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Stack-based buffer overflow in Microsoft Exchange Server allows an unauthorized attacker to execute code over a network.

Severity
Critical · CVSS 8.1
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Remote Code Execution, 2026-Oct
AI analysis
Critical priority · generated by qwen2.5:7b · possibly affects Exchange Online · verify against the original
Not analysed

CVE-2026-70279: Microsoft Exchange Server Spoofing Vulnerability

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Improper neutralization of input during web page generation ('cross-site scripting') in Microsoft Exchange Server allows an unauthorized attacker to perform spoofing over a network.

Severity
Important · CVSS 9.3
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Spoofing, 2026-Oct
Not analysed

CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege Vulnerability

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Weak authentication in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Severity
Important · CVSS 8.8
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Elevation of Privilege, 2026-Oct
Not analysed

CVE-2026-69881: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

Windows · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

Severity
Important · CVSS 7.5
Type
Security updates
Services
Exchange Online
Tags
Windows IKE Extension, Denial of Service, 2026-Sep
Not analysed

CVE-2026-69641: Microsoft Exchange Server Elevation of Privilege Vulnerability

Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Severity
Important · CVSS 9.1
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Elevation of Privilege, 2026-Sep
Not analysed

CVE-2026-69587: Windows Internet Key Exchange (IKE) Extension Denial of Service Vulnerability

Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

Windows · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Null pointer dereference in Windows IKE Extension allows an unauthorized attacker to deny service over a network.

Severity
Important · CVSS 7.5
Type
Security updates
Services
Exchange Online
Tags
Windows IKE Extension, Denial of Service, 2026-Sep
Not analysed

CVE-2026-69429: Windows Internet Key Exchange (IKE) Protocol Extensions Remote Code Execution Vulnerability

Heap-based buffer overflow in Windows IKE Extension allows an authorized attacker to execute code over a network.

Windows · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Heap-based buffer overflow in Windows IKE Extension allows an authorized attacker to execute code over a network.

Severity
Important · CVSS 7.5
Type
Security updates
Services
Exchange Online
Tags
Windows IKE Extension, Remote Code Execution, 2026-Sep
Not analysed

CVE-2026-69382: Microsoft Exchange Server Information Disclosure Vulnerability

Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Use of a broken or risky cryptographic algorithm in Microsoft Exchange Server allows an unauthorized attacker to disclose information over a network.

Severity
Important · CVSS 5.9
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Information Disclosure, 2026-Sep
Not analysed

CVE-2026-69380: Microsoft Exchange Server Elevation of Privilege Vulnerability

Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Missing authorization in Microsoft Exchange Server allows an authorized attacker to elevate privileges over a network.

Severity
Important · CVSS 8.1
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Elevation of Privilege, 2026-Sep
Not analysed

CVE-2026-69378: Microsoft Exchange Server Denial of Service Vulnerability

Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.

Microsoft 365 / Office · msrc Original Microsoft announcement ↗
Details

Original Microsoft text

Uncontrolled recursion in Microsoft Exchange Server allows an unauthorized attacker to deny service over a network.

Severity
Important · CVSS 7.5
Type
Security updates
Services
Exchange Online
Tags
Microsoft Exchange Server, Denial of Service, 2026-Sep