Microsoft Exchange flaw allows hackers to read mailboxes across an organization, so patch now

• Microsoft issues fix for CVE-2026-96940, a high-severity Exchange privilege-escalation flaw
• Attackers with compromised user credentials could access other employees’ mailboxes and emails
• No active exploitation reported, but Microsoft labeled the vulnerability “exploitation more likely”

Microsoft has pushed an urgent update for Exchange Server which fixes a high-severity flaw that could wreak some serious havoc among email users.

The company patched CVE-2026-96940, a “weak authorization in Microsoft Exchange Server [that] allows an authenticated attacker to elevate privileges over a network,” as per the National Vulnerability Database (NVD).