// Microsoft 365HIGH
Microsoft published CVE-2026-96940, a high-severity elevation of privilege vulnerability in Microsoft Exchange Server 2016, 2019, and Subscription Edition. An authenticated attacker can exploit weak authorization to access other users' mailboxes within the same organization without user interaction. CVSS score 8.8. Microsoft rates exploitation as "More Likely" and has released patches (KB5129958, KB5129957, KB5129956, KB5129955).
- CVE-2026-96940: Microsoft Exchange Server Elevation of Privilege(opens in a new tab)
- Microsoft Exchange Server Flaw Lets Authenticated Hackers Access(opens in a new tab)
- Microsoft Releases Emergency Exchange Server Update to Fix CVE-2(opens in a new tab)
- Out-of-band Exchange Server update fixes high-severity mailbox a(opens in a new tab)
- Microsoft Exchange Flaw Lets Authenticated Attackers Read Other (opens in a new tab)
- CVE-2026-96940: Microsoft Exchange Flaw Lets Attackers Read Mail(opens in a new tab)
// Get alerts for Microsoft 365