HighCVECVE-2026-96940
Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users' Mailboxes
The Hacker News·Source published ·1 min read
What happened?
Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions. The vulnerability, tracked as CVE-2026-96940, is rated 8.8 on the CVSS scoring system. "Weak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a
Key details
- Authenticated attacker can elevate privileges over a network
- Attacker can read other users' mailboxes and attachments
- Exchange Online customers are not required to take action
- Redmond credited researcher Jan Mitchell with discovering the flaw
Affected
- Exchange Server Subscription Edition RTM is affected
- Exchange Server 2016 Cumulative Update 23 is affected
- Exchange Server 2019 Cumulative Update 15 is affected
- Exchange Server 2019 Cumulative Update 14 is affected
Summarised by SecOraLens from The Hacker News. Always read the original source before acting. How SecOraLens verifies advisories.