Microsoft has issued urgent security updates to tackle a significant vulnerability in its Exchange Server, a flaw that could potentially allow attackers to gain elevated privileges. The issue, identified as CVE-2026-96940, poses a serious threat as it enables authenticated users to access mailboxes of other users within the same organization.
Details of the Vulnerability
Rated 8.8 on the CVSS scale, the vulnerability is due to weak authorization controls within Microsoft Exchange Server. Exploiting it allows unauthorized reading of emails and attachments, though it does not facilitate access across different tenants. Microsoft announced these findings on October 2, 2026, emphasizing the need for immediate action by affected users.
Actions Taken by Microsoft
To mitigate this threat, Microsoft has implemented a service-side fix for Exchange Online, ensuring that customers using this service are automatically protected without requiring further action. However, administrators of on-premises Exchange Server products must promptly apply the provided updates.
The affected versions include Microsoft Exchange Server Subscription Edition RTM, Exchange Server 2016 Cumulative Update 23, and Exchange Server 2019 Cumulative Updates 14 and 15. The vulnerability was discovered and reported by Microsoft researcher Jan Mitchell, and although there are no reports of active exploitation, Microsoft highlights the potential for future attacks.
Broader Security Implications
This disclosure follows recent warnings from Broadcom’s Symantec regarding vulnerabilities in Microsoft SharePoint being exploited by the China-linked Warlock group. These threats underline the ongoing risks to organizations, particularly in Portuguese- and Spanish-speaking regions, where Warlock ransomware has been deployed.
Given the Exploitability assessment of “Exploitation More Likely,” Microsoft urges users to swiftly implement the security patches to safeguard their systems. Staying updated is crucial in the face of evolving cybersecurity threats.
Ensuring the security of IT infrastructure is vital as cyber threats continue to grow. Organizations are advised to regularly review and update their systems to protect against potential vulnerabilities.
