Microsoft has released a fix for CVE-2026-96940, a high-severity flaw rated 8.8 on the CVSS scale in Exchange Server, the company's on-premises corporate email platform.
The vulnerability allows an authenticated user inside the organization to access any other user's mailbox without needing administrative privileges. Access is not limited to message headers; the attacker can read full email content and open attachments such as contracts, spreadsheets, and other documents exchanged via email.
Authentication does not meaningfully reduce the risk. Any valid account in the organization works, including those belonging to regular employees, contractors, or credentials obtained through phishing. This turns a minor compromise into a serious incident, as one low-privilege account can expose correspondence from the board, legal, or finance departments.
The affected versions are Exchange Server Subscription Edition RTM, Exchange 2016 CU23, Exchange 2019 CU15, and Exchange 2019 CU14. Organizations running these on-premises releases must install the update. Exchange Online customers require no action, as Microsoft applied the fix on the service side.
Microsoft assessed the flaw as likely to be exploited and noted that no evidence of active attacks existed at the time of disclosure.
