Microsoft has released an emergency update for a flaw in its self-hosted Exchange email servers that
lets any employee or attacker with a valid login read other people’s emails and attachments within the
same organisation. No attacks have been reported yet, but Microsoft expects attackers to start
exploiting it. Organisations running their own Exchange servers should install the 2 October 2026
update now; Microsoft’s cloud service, Exchange Online, has already been fixed.
1. Vulnerability Details
CVE ID- CVE-2026-96940
CVSS SCORE- 8.8 (temporal 7.7) CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
EXPLOIT STATUS – Not exploited; Exploitation More Likely
CWE-1390: Weak Authentication. Microsoft describes the flaw as weak authorization in Exchange Server that lets an
authenticated attacker elevate privileges over a network. A low-privileged user who exploits it can access other users’
mailboxes within the same organisation and read email messages and attachments. It does not allow access across
tenant boundaries. Microsoft rates maximum severity Important, with exploit code maturity Unproven.
2. Affected Products & Fixed Versions
| COMPONENT | VULNERABLE VERSIONS | FIXED BUILD |
| Microsoft Exchange Server Subscription Edition | RTM | Install the 2 October 2026 security update (KB512995) |
| Microsoft Exchange Server 2019 | Cumulative Update 15 | Install the 2 October 2026 security update (KB512995) |
| Microsoft Exchange Server 2019 | Cumulative Update 14 | Install the 2 October 2026 security update (KB512995) |
| Microsoft Exchange Server 2016 | Cumulative Update 23 | Install the 2 October 2026 security update (KB512995) |
3. Observed Activity
- 2 October 2026: Microsoft published CVE-2026-96940 with out-of-band security updates for on-premises Exchange Server. The flaw was found internally by Jan Mitchell of Microsoft.
- Exploitability: Microsoft reports the flaw as not publicly disclosed and not exploited at publication, but assesses exploitation as More Likely.
- Exchange: Online Microsoft has already deployed a related service-side fix to Exchange Online. Exchange Online customers do not need to take any action.
4. Recommendations
- List all on-premises Exchange servers, including hybrid servers, and check builds with Get-Exchange Server | Format-List Name, AdminDisplayVersion against Subscription Edition RTM, 2019 CU14/CU15, and 2016 CU23.
- Install Microsoft’s 2 October 2026 out-of-band security update (KB 512995) on every affected Exchange server; Exchange Online tenants need no action.
- Review mailbox audit logs (Search-MailboxAuditLog, MailItemsAccessed) for non-owner access to other users’ mailboxes before the update was installed, starting with executive and finance mailboxes.
7. Sources
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2026-96940
- https://thehackernews.com/2026/10/microsoft-exchange-flaw-lets.html
Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn
No related posts found.