Microsoft Exchange Flaw Allows Authenticated Users to Read Other Mailboxes

Microsoft released out-of-band security updates in October 2026 addressing a high-severity flaw in its Exchange Server product line. The vulnerability is tracked as CVE-2026-96940 and has a CVSS score of 8.8, indicating it can be easily exploited once an attacker has some level of authentication on the network. The flaw stems from insufficient authorization checks when accessing certain APIs, allowing an authenticated user to elevate privileges and potentially read mailboxes belonging to other users¹.

The defect mirrors older privilege‑escalation exploits such as EternalBlue (CVE‑2017‑5648) used by WannaCry ransomware; both involve flaws that let attackers gain administrative control within systems already compromised at lower levels of trust¹. Because the attack requires only basic authenticated access—common for insider threats or compromised accounts—the window for exploitation is wide. Organizations are advised to apply the patches immediately and monitor their Exchange servers for unusual activity until full remediation is confirmed, as delays could lead to data exfiltration or further compromise¹.

In practice, this means administrators should verify that all Exchange instances—including legacy versions still in use—are updated with Microsoft’s latest fixes and review delegation settings to ensure no misconfigured permissions remain. By acting swiftly, firms can prevent lateral movement within their networks that would otherwise allow attackers to move freely between mailbox accounts¹.