Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940)

Microsoft has issued an unscheduled security update for Exchange Server addressing CVE-2026-96940, a high-severity flaw that could let an already-authenticated attacker read emails and attachments belonging to other users within the same organization. The company clarifies that the bug cannot be used to cross tenant boundaries, and the internal Exchange Server Team says it has seen no signs of real-world exploitation so far. Still, Microsoft warns that this class of flaw has been abused before and urges admins to patch promptly rather than wait. The rollout was messy: a matching fix was quietly pushed to Exchange Online last week without accompanying documentation, catching customers off guard before Microsoft admitted the update went out ahead of its planned schedule. On-premises customers running Exchange Server Subscription RTM, Exchange Server 2019 (CU14/CU15), or Exchange Server 2016 CU23 should apply the September 2026 v2 update, and Microsoft recommends installing it on every Exchange server plus any machine running the Exchange Management Tools.