Microsoft Patches Urgent Exchange Flaw Exposing Corporate Mailboxes

Microsoft has pushed an urgent update for Exchange Server to address a high-severity security flaw carrying an 8.8 out of 10 CVSS rating. Tracked as CVE-2026-96940, the weak authorization vulnerability affects on-premises deployments of Microsoft Exchange Server 2016 and 2019. While cloud-based Exchange Online customers are already protected via service-side mitigations, organizations running local servers face potential internal data exposure if they fail to apply the update immediately.

The vulnerability allows an attacker who has already gained low-privileged user credentials to escalate their privileges within the network. By doing so, threat actors can bypass standard restrictions and read confidential emails, attachments, and internal discussions belonging to other users within the same organization. Security researchers point out that obtaining initial credentials is often trivial for attackers using phishing campaigns or credentials purchased from the dark web.

Although the flaw does not grant full administrator or SYSTEM-level control over the underlying Windows operating system, the targeted access to sensitive corporate mailboxes presents severe risks for follow-up attacks like Business Email Compromise. Microsoft noted that Exchange Server 2016 and 2019 reached end of support last year, meaning these updates are strictly available to organizations enrolled in the Period 2 Extended Security Update program or utilizing the Exchange Server Subscription Edition.

Administrators responsible for local enterprise infrastructure must deploy the patch immediately. Microsoft has labeled the bug as exploitation more likely, despite no active zero-day attacks being reported at the time of the advisory. Post-installation, IT teams are strongly encouraged to run the Exchange Server Health Checker tool to verify successful deployment and close off potential entry points.