Microsoft released an out-of-band security update for Exchange Server addressing CVE-2026-96940, a high-severity vulnerability allowing authenticated attackers to read emails and attachments of other users in the same organization. The flaw does not permit cross-tenant access. Microsoft stated it is not aware of active exploitation but notes this type of vulnerability has been exploited in the past. The update is available for Exchange Server Subscription RTM, 2019 CU14-15, and 2016 CU23.
- Out-of-band Exchange Server update fixes high-severity mailbox a(opens in a new tab)
- Microsoft Exchange Flaw Lets Authenticated Attackers Read Other (opens in a new tab)
- Microsoft Releases Emergency Exchange Server Update to Fix CVE-2(opens in a new tab)
- CVE-2026-96940: Microsoft Fixes Exchange Server Flaw For Which E(opens in a new tab)
- Microsoft Exchange flaw allows hackers to read mailboxes across (opens in a new tab)
// Get alerts for Microsoft Azure