Microsoft Issues Out-of-Band Exchange Updates for Flaw That Could Expose Other Users’ Mailboxes
Summary
Microsoft released out-of-band updates for Exchange Server flaw CVE-2026-96940, which could let authenticated attackers read other users’ mailboxes. Exchange Online is already fixed; on-premises users should install the updates.
Key points
- CVE-2026-96940 is a high-severity Exchange Server authorization flaw rated 8.8 on the CVSS scale.
- An authenticated attacker could exploit it over a network to gain access to other users’ mailboxes in the same organization and read messages and attachments.
- The flaw does not allow access across tenants.
- Microsoft says Exchange Online has received a service-side fix, so customers do not need to take action.
- Organizations using affected on-premises Exchange Server products should install Microsoft’s out-of-band updates.
- Microsoft reports no evidence of in-the-wild exploitation but rates exploitation as more likely.
Article Details
- Vulnerability Types
- Weak authorization
- Privilege escalation
- Severity
- High (CVSS 8.8)
- Exploitation Status
- not_reported
- Exploit Availability
- unknown
- Patch Status
- available
CVE
People
Threat Actors
Malware
Vendors
Products
Exchange OnlineMicrosoft has already deployed a "related service-side fix" to Exchange Online to address the issue. As a result, Exchange Online customers are not required to take any action.Microsoft Exchange ServerMicrosoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions.Microsoft SharePointSymantec warned that the China-linked Warlock actor is exploiting multiple vulnerabilities in Microsoft SharePoint to deploy its namesake ransomware in attacks targeting organizations in Portuguese- and