Microsoft has released an out-of-band security update for Exchange Server to patch CVE-2026-96940, a high-severity vulnerability that allows authenticated attackers to read emails and attachments belonging to other accounts in the same organization.
Internal Privilege Escalation Risk
The Exchange Server Team discovered the vulnerability during internal testing and reported that there is no evidence of active exploitation. However, Microsoft cautioned system administrators to apply the fix promptly, noting that the vulnerability could be consistently exploited and that similar mailbox access flaws have been targeted by threat actors in the past.
The security flaw is strictly confined to internal environments. Microsoft clarified that the issue does not permit unauthorized data access across organization tenant boundaries.
Unintended Patch Deployment Sequence
The out-of-band patch follows a service-side deployment to Exchange Online late last week, which initially caught system administrators off guard because it lacked accompanying Knowledge Base documentation.
Microsoft subsequently acknowledged the confusion, explaining that the release sequence occurred ahead of its planned timeline. The company did not state what caused the early publication.
Affected Platforms and Deployment Guidance
The out-of-band update, designated as the September 2026 v2 update, applies to several active versions of the software. Patches are available for Exchange Server Subscription RTM, Exchange Server 2019 Cumulative Updates 14 and 15, and Exchange Server 2016 Cumulative Update 23.
Microsoft recommends installing the security update on all on-premises Exchange Servers as well as any management client machines running Exchange Management Tools to prevent version compatibility issues.
AI-generated editorial illustration; not a documentary photograph.
Source: Out-of-band Exchange Server update fixes high-severity mailbox access bug (CVE-2026-96940)
SIGNAL TITANS
Leave a Reply