Microsoft Exchange flaw could expose mailboxes across an organization

Microsoft has released a security update for CVE-2026-96940, a high-severity vulnerability in Microsoft Exchange Server. The flaw has a severity rating of 8.8/10. The National Vulnerability Database describes it as weak authorization that allows an authenticated attacker to elevate privileges over a network.

An attacker would need authenticated access to exploit the flaw. Microsoft says the vulnerability could let a user with low privileges raise their privileges within Exchange and access other people’s mailboxes in the same organization. The flaw does not enable cross-tenant access, and Microsoft’s disclosed scenario does not grant administrator or SYSTEM-level privileges on the underlying Windows server.

Microsoft says it has no evidence that attackers have exploited the flaw. It has nevertheless labeled exploitation “more likely.” The company issued the patch on October 2 as part of its September 2026 V2 Exchange Server Security Updates, ahead of its intended schedule. Microsoft says the main difference from the original September 8 updates is the fix for CVE-2026-96940.

Exchange Online users are already covered by a related service-side fix. Microsoft says organizations running on-premises Exchange Server should install the latest update. Affected releases are Exchange Server Subscription Edition RTM, Exchange Server 2016 Cumulative Update 23, and Exchange Server 2019 Cumulative Updates 15 and 14. The 2016 and 2019 products reached end of support last year; Microsoft says security updates for them are available to organizations enrolled in its Period 2 Extended Security Update program, covering updates released from May through the end of October 2026. Administrators can run Microsoft’s Exchange Server Health Checker after installation to verify the update and see whether further action is required.