Cybersecurity
Microsoft patches Exchange flaw exposing mailboxes
Microsoft released out-of-band fixes for an Exchange Server vulnerability that could let an authenticated attacker read other users’ mailboxes within the same organisation, while Exchange Online had already been fixed.
- Microsoft issued out-of-band security updates on 2 October 2026 for CVE-2026-96940 in Exchange Server.
- Microsoft rated the flaw 8.8 on the CVSS scale and said it involved weak authorisation.
- Microsoft said an authenticated attacker could gain access to other users’ mailboxes in the same organisation and read messages and attachments.
- Microsoft said Exchange Online had already received a related service-side fix, and on-premises customers needed to install updates.
- Microsoft credited researcher Jan Mitchell and said it had no evidence of in-the-wild exploitation.
Microsoft released out-of-band security updates on 2 October 2026 to address CVE-2026-96940 in Microsoft Exchange Server. It said the issue carried a CVSS score of 8.8 and involved weak authorisation in the product.
According to Microsoft, an authenticated attacker could use the flaw to elevate privileges over the network. The company said that could let the attacker reach other users’ mailboxes within the same organisation and read messages and attachments, but not cross-tenant data.
Microsoft said it had already applied a related fix on the service side for Exchange Online, so those customers did not need to act. Users of affected on-premises releases were told to install the updates.
The versions Microsoft listed were Exchange Server Subscription Edition RTM, Exchange Server 2016 Cumulative Update 23, Exchange Server 2019 Cumulative Update 15 and Exchange Server 2019 Cumulative Update 14. The company credited Microsoft researcher Jan Mitchell for finding and reporting the issue.
Microsoft said it had seen no evidence that the flaw had been used in the wild. It also marked the issue with an exploitability assessment of “Exploitation More Likely.”
Named in this story
People
- Jan Mitchell
- was credited with finding and reporting the flaw
Companies
- Microsoft
- issued the out-of-band fixes and described the flaw
Products and systems
- Microsoft Exchange Server
- contained the vulnerability and was the affected on-premises software
- Microsoft Exchange Online
- had already received a service-side fix
How the source tells it
The piece was largely a straight security notice, with a mild sense of urgency from the advice to patch promptly.
- urgency imperative advisory language urging customers to install the updates quickly