Microsoft Exchange flaw lets attackers access mailboxes

Microsoft has released urgent updates for Exchange Server after disclosing a high-severity vulnerability, CVE-2026-96940. The flaw allows attackers with any valid account on Exchange to access other users’ mailboxes, potentially exposing emails and attachments organization-wide. Microsoft rates the risk of exploitation as high, although there is no evidence of attacks in the wild. Exchange Online is already protected, but on-premises servers require manual patching to prevent abuse.

• Vulnerability allows privilege escalation within Exchange Server
• Attackers need an authenticated Exchange account
• No cross-tenant access is possible
• Exchange Online protected already; on-premises servers must patch
• No active exploitation reported, but exploitation labeled likely