Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes

Microsoft has issued emergency, out-of-band patches for a high-severity bug in on-premises Exchange Server, identified as CVE-2026-96940 with a CVSS score of 8.8. The flaw stems from weak authorization checks and lets an already-authenticated attacker escalate privileges to access and read another user's mailbox—including messages and attachments—within the same organization, though cross-tenant access is not possible. Affected products include Exchange Server Subscription Edition RTM, Exchange Server 2016 CU23, and Exchange Server 2019 CU14/CU15; Exchange Online has already received a server-side fix so cloud customers need not act. Microsoft credits its own researcher Jan Mitchell for the find, notes no active exploitation yet, but rates it as 'Exploitation More Likely,' urging on-prem admins to apply updates promptly—news that follows separate reports of the Warlock group abusing SharePoint flaws for ransomware attacks.