Microsoft Patches Exchange Server Flaw That Let Users Read Each Other's Mail

Microsoft has shipped out-of-band security updates for a high-severity flaw in Microsoft Exchange Server. Tracked as CVE-2026-96940, the bug carries a CVSS score of 8.8.

What's at stake

In the company's own words, from an advisory dated October 2, 2026, "weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network."

In practice, an attacker who has already authenticated could gain unauthorized access to other users' mailboxes within the same organization and read their messages and attachments. The good news, such as it is: the flaw does not permit cross-tenant access, so an attacker cannot step outside their own organization.

Who needs to act

For cloud-based Exchange Online, Microsoft has already deployed a related service-side fix, so those customers need do nothing.

Administrators running on-premises deployments, however, must install the patches themselves. The affected products are:

• Microsoft Exchange Server Subscription Edition RTM;
• Microsoft Exchange Server 2016 Cumulative Update 23;
• Microsoft Exchange Server 2019 Cumulative Update 15;
• Microsoft Exchange Server 2019 Cumulative Update 14.

Microsoft credited its own researcher, Jan Mitchell, with discovering and reporting the issue.

Why the hurry

There is no evidence the flaw has been exploited in the wild yet, but Microsoft has tagged it "Exploitation More Likely" — a hint to administrators not to sit on the fix.

The disclosure lands days after Broadcom-owned Symantec warned that the China-linked Warlock actor is exploiting several Microsoft SharePoint vulnerabilities to deploy its namesake ransomware against organizations in Spanish- and Portuguese-speaking countries.

Source: The Hacker News