Microsoft issues emergency Exchange Server fixes for privilege escalation flaw

The vulnerability, tracked as CVE-2026-96940, involves weak authorization that can allow authenticated attackers to gain higher privileges under certain conditions. TechRadar reports that Exchange Server 2016 and 2019 are affected and that the flaw can expose mailboxes across an organization, allowing attackers to read other users' messages.

• The vulnerability has a CVSS severity score of 8.8.

Covered by 3 publishers within 22 hours of the first report.

• The Hacker News: Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes

Reporting3

THN The Hacker News Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes · info@thehackernews.com (The Hacker News) 12:21 PM

SAF Security Affairs CVE-2026-96940: Microsoft Fixes Exchange Server Flaw For Which Exploitation Is More Likely · Pierluigi Paganini 10:09 AM

TRD TechRadar Microsoft Exchange flaw allows hackers to read mailboxes across an organization, so patch now · Sead Fadilpašić 10:29 AM

Related

PC Skip the Wait. Microsoft's 26H2 Update Fixes the Parts You Hate Most About Windows 11 October 1

PC Skip the Wait. Microsoft's 26H2 Update Fixes the Parts You Hate Most About Windows 11 September 30

BC Nikkei says attackers breached employee email accounts October 5

REC ClickFix attackers hide malware payloads in browser caches October 5

Topics Microsoft