Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes

Microsoft has released out-of-band security updates to address a high-severity vulnerability in Microsoft Exchange Server tracked as CVE-2026-96940. The flaw carries a CVSS score of 8.8 and stems from weak authorization controls within Exchange Server. An authenticated attacker can exploit this vulnerability to escalate privileges and potentially read other users' mailboxes. The out-of-band nature of the patch release indicates urgency on Microsoft's part. The vulnerability poses a significant risk in enterprise environments where Exchange Server is widely deployed for email communication.