Microsoft has released out-of-band security updates for on-premises Exchange Server to close a high-severity flaw that lets a signed-in user read other people's email in the same organization, The Hacker News reported Monday. The bug, tracked as CVE-2026-96940, carries a CVSS score of 8.8, and Microsoft says it found the issue itself.

What Happened

The vulnerability is a weak-authorization error that allows privilege escalation. An attacker who already holds a valid account inside an organization can use it to open other users' mailboxes and read their messages and attachments. The access stops at the organization's edge: Microsoft says the flaw cannot be used to cross tenant boundaries.

Affected versions are Exchange Server Subscription Edition RTM, Exchange Server 2019 Cumulative Updates 14 and 15, and Exchange Server 2016 Cumulative Update 23. Microsoft's advisory is dated Oct. 2. Exchange Online, the hosted service, received a service-side fix late the previous week, so cloud customers do not need to do anything.

RelatedSuspected Chinese Spies Exploited BeyondTrust Remote Support Flaw Since August, Google Says

The Hacker News credited Microsoft researcher Jan Mitchell with finding and reporting the bug. Microsoft says it has seen no exploitation in the wild but rates the flaw "Exploitation More Likely" in its assessment.

The rollout was unusual. Help Net Security reported that the fix first appeared without the knowledge base documentation that normally accompanies an Exchange update, and that Microsoft acknowledged the update had been published ahead of its intended schedule. The fix ships as the September 2026 v2 security update, which Microsoft recommends installing on every Exchange server and on any workstation running the Exchange Management Tools, so that the management tools stay compatible across an environment.

Why It Matters

The requirement for an existing account limits who can use the flaw, but it does not make it minor. Phished credentials, password spraying and compromised contractor accounts routinely give outside attackers a foothold as an ordinary user. With this bug, that foothold could be turned into access to executives' inboxes, legal correspondence or finance approvals without any further privilege escalation on the network.

Mailbox access is especially prized by espionage groups, and on-premises Exchange has been a recurring target. The ProxyLogon flaws in 2021 were exploited at scale by a China-linked group, and the ProxyShell and ProxyNotShell bugs that followed were used by both state-backed and criminal actors. Organizations that still run Exchange on their own hardware are often those with regulatory or sovereignty reasons to keep mail in-house, which also makes their mailboxes attractive.

Patching Considerations

Because Microsoft's fix is now public, attackers can compare patched and unpatched builds to work out the exact flaw, a routine step that has shortened the gap between disclosure and attack for earlier Exchange bugs. Administrators running older cumulative updates than those listed may first need to move to a supported CU before they can apply the security update, since Microsoft ships Exchange security fixes only for current cumulative updates.

What to Watch

The main question is whether exploitation appears in the coming days now that the update can be studied. Watch for any change to Microsoft's exploitability rating, proof-of-concept code from researchers and guidance from national cybersecurity agencies urging rapid patching. Microsoft's next regular Patch Tuesday, on Oct. 13, may also bring further Exchange fixes or updated documentation for this one.