Exchange Server flaw lets a signed-in user read colleagues' mailboxes

Exchange Server flaw lets a signed-in user read colleagues' mailboxes

2 October 2026: Microsoft has fixed CVE-2026-96940, a weak-authorisation bug in on-premises Exchange Server that lets anyone with a valid account open other users' mailboxes in the same organisation, messages and attachments included. It rates the flaw Important, CVSS 8.8, with exploitation "more likely". The fix is in a second round of September security updates, labelled September 2026 V2. Microsoft says the bug was not public before the fix and it has seen no attacks.

Exchange Online was fixed on Microsoft's side, so organisations with only cloud mailboxes have nothing to install. The servers at risk run Exchange Server Subscription Edition RTM, Exchange 2019 Cumulative Update 14 or 15, or Exchange 2016 Cumulative Update 23.

That last group carries a catch. Exchange 2016 and 2019 reached end of support in October 2025, and Microsoft now ships their security updates only to organisations enrolled in the second period of its paid Extended Security Update programme. Without that enrolment there is no fix, and Microsoft's answer is to move to Subscription Edition.

A stolen password is enough to use this. Reading the finance team's or a director's mail is the usual first step in invoice fraud, which makes a hybrid server kept only for recipient management as worth patching as a full mail server.

Microsoft lists two known issues with the V2 updates: HTTP 500 errors on some calendar .ics links, and a deadlock in the Korean word breaker used by search. Mailbox audit logs will show access by accounts that hold no permission on the mailboxes they opened.

Company profile on TrustList: Microsoft

Related on TrustList:

• Windows 10 Extended Security Updates year two: commercial price doubles to $122 per device from mid-October 2026
• Entra ID stops processing MemberOf dynamic rules on 3 November
• Outlook will block .msix and .msixbundle attachments from November

Sources

• Microsoft Security Response Center: CVE-2026-96940, 2 October 2026
• Microsoft Exchange Team: Released September 2026 V2 Exchange Server Security Updates, 2 October 2026
• The Hacker News: Microsoft Exchange flaw lets authenticated users access other mailboxes, 5 October 2026