Microsoft Patches Exchange Server Flaw (CVE-2026-96940)

Executive Summary

Microsoft has released an out-of-band security update to address CVE-2026-96940, a high-severity privilege escalation vulnerability in Microsoft Exchange Server. The vulnerability, which has a CVSS score of 8.8, stems from a weak authorization issue. A successful exploit allows an authenticated attacker to gain unauthorized access to read emails and attachments in other users' mailboxes within the same organization. Microsoft has deemed exploitation as "More Likely" and urges on-premises customers to apply the new security updates immediately. Customers using Exchange Online are already protected as the fix has been deployed on the service side.

Vulnerability Details

CVE-2026-96940 is a privilege escalation vulnerability that allows an authenticated attacker to elevate their privileges over the network. The core issue is a weak authorization check within Exchange Server. An attacker who has already authenticated to the Exchange server (e.g., with their own low-privilege credentials) can exploit this flaw to gain access to the mailboxes of other users in the same tenant. The scope of the attack is limited to reading mailbox content; it does not allow the attacker to send emails as the victim or modify mailbox contents. The vulnerability does not permit cross-tenant access.

The flaw was discovered and reported internally by Microsoft researcher Jan Mitchell.

Affected Systems

The vulnerability affects the following on-premises Microsoft Exchange Server versions:

• Microsoft Exchange Server Subscription Edition RTM
• Microsoft Exchange Server 2016 Cumulative Update 23
• Microsoft Exchange Server 2019 Cumulative Updates 14 and 15

Note: Exchange Online customers are not affected and do not need to take any action.

The fix is included in a reissuance of the September 2026 V2 Exchange Server Security Updates.

Exploitation Status

As of the advisory's release on October 2, 2026, Microsoft has found no evidence that CVE-2026-96940 is being actively exploited in the wild. However, the company has assigned it an exploitability assessment of "Exploitation More Likely." This indicates that the technical barrier to developing a functional exploit is relatively low, and threat actors are likely to do so in the near future. The public disclosure of the vulnerability increases the urgency for administrators to patch their systems.

Impact Assessment

The primary impact of this vulnerability is a significant loss of confidentiality. An attacker, even one with a non-privileged account, could potentially access sensitive information from the mailboxes of high-value targets such as executives, legal counsel, or system administrators. This could lead to the exposure of trade secrets, internal strategy documents, personally identifiable information (PII), and other confidential data. While the attacker cannot directly modify data, the stolen information can be used for extortion, corporate espionage, or to plan further attacks.

IOCs — Directly from Articles

No specific Indicators of Compromise (IOCs) were provided in the source articles.

Cyber Observables — Hunting Hints

Security teams can hunt for signs of exploitation by monitoring Exchange audit logs:

Detection Methods

1. Audit Log Review: The most effective detection method is to analyze Exchange mailbox audit logs. Enable audit logging for mailbox owner, delegate, and administrator access. Create SIEM alerts to trigger when a user account accesses a mailbox it does not own and is not a registered delegate for. Correlate these alerts with user role and typical behavior to identify anomalies.
2. PowerShell Scripts: Use PowerShell scripts to query mailbox audit logs across the organization for suspicious cross-mailbox access patterns. For example, search for MailboxLogin events where LogonUserSid does not match the MailboxOwnerSid and the ClientProcessName is not a known service.

Remediation Steps

1. Install Security Updates: The primary and most critical step is to install the out-of-band security updates released by Microsoft for all affected on-premises Exchange Servers. This is the only way to fully remediate the vulnerability.
2. Enable Audit Logging: Ensure that mailbox audit logging is enabled for all mailboxes in the organization. This will not prevent an attack but is crucial for detecting potential exploitation attempts and for forensic investigation.
3. Apply Principle of Least Privilege: Review and limit user permissions within the Exchange environment to ensure that users only have the access they absolutely require.