Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
Summary: Microsoft released out-of-band updates for a high-severity Exchange Server flaw, CVE-2026-96940, rated 8.8 on CVSS, that lets an authenticated attacker exploit weak authorization to gain unauthorized access to other users' mailboxes in the same organization and read their email and attachments. Microsoft said the flaw does not allow cross-tenant access, has deployed a related service-side fix to Exchange Online so those customers need take no action, and advises on-premises users to install the updates; researcher Jan Mitchell is credited with reporting it.
What you should know: Microsoft tagged the flaw 'Exploitation More Likely' even with no evidence of in-the-wild use, so any authenticated account on an unpatched on-premises Exchange server is a potential path into every mailbox in the organization.
Read the original at The Hacker News ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2026-96940
- Related
- ⚡ Weekly Recap: Helpdesk 0-Days, Rogue Certs, Shiny Hunters Arrest, AI-Fooling Malware and More Cyber Risks ·Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026