Microsoft has released security updates for CVE-2026-96940, an authorization flaw in on-premises Exchange Server that lets any authenticated user in an organization read other users' mail and attachments. Exchange Online is already fixed on the service side; on-premises servers are not protected until the update is installed.
What happened
Microsoft published CVE-2026-96940 in the Security Update Guide on October 2, 2026, under the title "Microsoft Exchange Server Elevation of Privilege Vulnerability." Microsoft rates it Important, with a CVSS 3.1 base score of 8.8 (AV:N/AC:L/PR:L/UI:N). The advisory describes it as weak authorization in Exchange Server and maps it to CWE-1390 (Weak Authentication). The Hacker News reported the release as an out-of-band update, outside the normal Patch Tuesday schedule.
Microsoft's FAQ explains the impact:
An authenticated attacker who successfully exploited this vulnerability could gain unauthorized access to other users' mailboxes within the same organization and read email messages and attachments.
Microsoft says the flaw does not allow access across tenant boundaries. It has not been publicly disclosed or exploited, but Microsoft's exploitability assessment for the latest release is "Exploitation More Likely."
Affected versions and the fixed builds listed by MSRC:
| Product | KB | Fixed build |
|---|---|---|
| Exchange Server Subscription Edition RTM | 5129955 | 15.02.2562.053 |
| Exchange Server 2019 CU15 | 5129956 | 15.02.1748.053 |
| Exchange Server 2019 CU14 | 5129957 | 15.02.1544.048 |
| Exchange Server 2016 CU23 | 5129958 | 15.01.2507.075 |
The advisory lists no mitigations or workarounds, so installing the update is the only fix Microsoft documents.
Why it matters
An attacker only needs low privileges (PR:L) and no user interaction. Any working mailbox credential in the org is enough. A phished frontline account, a password-sprayed contractor login, or a service account with a mailbox can be used to read the CFO's mail, legal correspondence, or HR attachments, without any mailbox delegation or permissions being granted. Access reviews of mailbox permissions won't catch this, because the attacker never gets a permission that would show up in a review.
This is also why credential hygiene for low-value accounts matters. Many organizations focus MFA enforcement, sign-in monitoring and deprovisioning on privileged users. With this bug, an ordinary mailbox account that never got proper attention, such as a stale leaver account, a shared mailbox with a known password, or an account allowed to use legacy authentication, can reach the whole org's mail. Hybrid customers should note that the Exchange Online fix doesn't cover their on-premises servers.
What to check in your environment
- Inventory every on-premises Exchange server, including hybrid management servers, DR nodes and edge cases you keep "just for SMTP relay." Record version and CU for each.
- Compare each server's build to the fixed builds above and install the matching KB (5129955, 5129956, 5129957 or 5129958). The advisory lists only SE RTM, 2019 CU14/CU15 and 2016 CU23. MSRC lists no update for any other CU, so servers on older CUs have no fix from this release.
- Don't stop at the cloud. If you're hybrid, Microsoft's service-side fix covers only Exchange Online. Any mailbox still hosted on-premises is exposed until its server is updated.
- Close off stale credentials. Disable leaver accounts that still have on-prem mailboxes, rotate passwords on shared and service mailboxes, and confirm MFA and legacy-auth restrictions apply to OWA and other external Exchange endpoints.
- Review mailbox audit logging coverage on on-prem servers for high-value mailboxes (executives, legal, HR, finance). Microsoft hasn't published indicators for this flaw, so audit data is the main record you can review. Check that it's retained long enough to look back to before you patched.
- Prioritize internet-facing servers. Since a valid credential is the only prerequisite, servers that publish OWA or other client access externally to the internet should be first in the patch window.