{"id":3387,"date":"2026-10-05T17:35:56","date_gmt":"2026-10-05T17:35:56","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3387"},"modified":"2026-10-05T17:35:56","modified_gmt":"2026-10-05T17:35:56","slug":"microsoft-exchange-flaw-lets-authenticated-attackers-read-other-users-mailboxes","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3387","title":{"rendered":"Microsoft Exchange Flaw Lets Authenticated Attackers Read Other Users’ Mailboxes"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 05, 2026<\/span><\/span>Vulnerability \/ Email Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges under certain conditions.<\/p>\n

The vulnerability, tracked as CVE-2026-96940<\/a><\/strong>, is rated 8.8 on the CVSS scoring system.<\/p>\n

\u00abWeak authorization in Microsoft Exchange Server allows an authenticated attacker to elevate privileges over a network,\u00bb Microsoft said in an advisory released on October 2, 2026.<\/p>\n

The Windows maker said an authenticated attacker can exploit this flaw to gain unauthorized access to other users’ mailboxes within the same organization and read email messages and attachments. However, the vulnerability does not allow cross-tenant access.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

Microsoft has already deployed a \u00abrelated service-side fix\u00bb to Exchange Online to address the issue. As a result, Exchange Online customers are not required to take any action.<\/p>\n

Users of affected on-premises Microsoft Exchange Server products are advised to install the updates to stay protected. The following versions are impacted –<\/p>\n

    \n
  • Microsoft Exchange Server Subscription Edition RTM<\/li>\n
  • Microsoft Exchange Server 2016 Cumulative Update 23<\/li>\n
  • Microsoft Exchange Server 2019 Cumulative Update 15<\/li>\n
  • Microsoft Exchange Server 2019 Cumulative Update 14<\/li>\n<\/ul>\n

    Redmond has credited Microsoft researcher Jan Mitchell with discovering and reporting the flaw. Although there is no evidence of the flaw being weaponized in the wild, Microsoft has tagged it with an Exploitability assessment of \u00abExploitation More Likely,\u00bb making it essential that users move quickly to apply the fixes.<\/p>\n

    The disclosure comes days after Broadcom-owned Symantec warned that the China-linked Warlock actor is exploiting multiple vulnerabilities in Microsoft SharePoint to deploy its namesake ransomware in attacks targeting organizations in Portuguese- and Spanish-speaking countries.<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

    \ue804Ravie Lakshmanan\ue802Oct 05, 2026Vulnerability \/ Email Security Microsoft has released out-of-band security updates to address a high-severity flaw in Microsoft Exchange Server that could allow an attacker to escalate privileges…<\/p>\n","protected":false},"author":1,"featured_media":3388,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[622,1831,1290,70,332,3664,147,1591,826],"class_list":["post-3387","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attackers","tag-authenticated","tag-exchange","tag-flaw","tag-lets","tag-mailboxes","tag-microsoft","tag-read","tag-users"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3387","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3387"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3387\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3388"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3387"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3387"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3387"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}